Glassworm Malware Hits OpenVSX and Microsoft Visual Studio Platforms with 24 New Packages

Cybersecuritynews •Tushar Subhra Dutta • December 2, 2025

The Glassworm malware campaign has resurfaced with unprecedented scale, deploying 24 malicious extensions across Microsoft Visual Studio Marketplace and OpenVSX over the past week. This latest wave of attacks demonstrates the persistent threat posed by supply chain compromises targeting developer tools. The malware specifically clones legitimate extensions for popular frameworks, including Flutter, Tailwind, Vim, Yaml, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GlassWorm Malware Resurfaces in Open VSX Extensions Following Token Leak The Open VSX registry faced a supply chain attack after access tokens were leaked, allowing threat actors to publish malicious extensions. The GlassWorm malware campaign has returned with new extensions targeting developers' credentials and cryptocurrency wallets, leveraging obfuscation techniques to evade detection. Over 10,000 downloads of the new malicious extensions have been reported. 15 sources 30

Extracted Entities

Glassworm Malware Hits OpenVSX and Microsoft Visual Studio Platforms with 24 New Packages

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Companies (2)

Malware (1)

Tools (1)