Back Cybersecuritynews

GlassWorm Infiltrated VSX Extensions with More than 22,000 Downloads to Attack Developers

Cybersecuritynews •Tushar Subhra Dutta • February 3, 2026

GlassWorm has emerged as a serious threat to developers using the Open VSX Registry, where popular VSX extensions were silently turned into delivery vehicles for malware. Threat actors compromised a trusted publisher account and pushed poisoned updates that looked like routine releases but actually carried a staged loader. These extensions, which had more than 22,000 […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malware Campaign Targets Open VSX Extension with 5,066 Downloads A sophisticated malware campaign has compromised the Open VSX extension marketplace, affecting over 5,000 developer workstations. The malicious package masqueraded as a legitimate Angular Language Service extension, embedding encrypted malware that activates upon opening HTML or TypeScript files. The attack utilized typosquatting and steganography techniques to evade detection. 20 sources 37

GlassWorm Infiltrated VSX Extensions with More than 22,000 Downloads to Attack Developers

The full story

Extracted Entities

Attack Types (2)

Companies (1)