Seven OpenVSX extensions were compromised on October 17, 2025, with 35,800 total downloads, and ten extensions were still actively distributing malware two days later. The malware harvests NPM, GitHub, and Git credentials, targets 49 different cryptocurrency wallet extensions, deploys SOCKS proxy servers turning developer machines into criminal infrastructure, and installs hidden VNC servers for complete remote access. The stolen credentials are used to automatically compromise additional packages and extensions, creating exponential spread through the developer ecosystem. It uses Google Calendar as backup C2 server. This means Glassworm is using a triple layer C2 set up with the Solana blockchain, the use of a direct IP connection and Google Calendar, making it very robust.
On October 19, a new infected extension was detected in Microsoft’s VSCode marketplace and it’s stiill active. [1]
OpenVSX Extensions (with malicious versions):
codejoy.codejoy-vscode[email protected]
codejoy.codejoy-vscode[email protected]
l-igh-t.vscode[email protected]
CodeInKlingon.git-worktree- @1.0.9
CodeInKlingon.git-worktree- @1.0.91
Microsoft VSCode Extensions:
This is an active campaign.
Make an audit of your installed extensions. Check for abnormal activity such as suspicious network connections, vulnerable dependencies and strange API usage.
Scan new extensions before you install them.
Only install extensions you need, and remove extensions that are no longer in use. Each installed extension extends your attack surface.
Evaluate extensions before installing them, check for reviews, extension history, publisher reputation etc.
Be careful when using auto-update, a compromised extension might install malware when auto-update is turned on.
Keep an extension inventory.
Consider a centralized allowlist for VSCode extensions.
217.69.3.218 (primary C2 server)
140.82.52.31:80/wall (exfiltration endpoint)
Solana Wallet: 28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2
49CDiVWZpuSW1b2HpzweMgePNg15dckgmqrrmpihYXJMYRsZvumVtFsDim1keESPCrKcW2CzYjN3nSQDGG14KKFM
Organizer: [email protected]
Persistence Mechanisms:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
[1]
Your current browser privacy settings may be preventing this form from loading properly. To continue, please allow cookies/tracking for this site or temporarily disable strict privacy protection, then refresh the page.
If you’re still experiencing issues, please us at [email protected]
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
