Back Gbhackers

GlassWorm Spreads via 72 Malicious Open VSX Extensions Hidden in Transitive Dependencies

Gbhackers •Divya • March 14, 2026

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GlassWorm Campaign Expands with 72 Malicious Open VSX Extensions The GlassWorm malware campaign has intensified its operations by utilizing 72 newly identified malicious Open VSX extensions. These extensions exploit transitive dependencies within developer environments, allowing the malware to spread more effectively. The Socket Research Team reported these findings on March 13, 2026, highlighting the campaign's sophisticated approach of embedding malicious payloads in dependencies rather than directly in initial extensions. This method broadens the attack surface, potentially affecting numerous developers and organizations using vulnerable extensions. The campaign continues to employ advanced techniques such as staged JavaScript execution and in-memory code execution. As of now, specific CVEs and remediation steps have not been disclosed, but the threat remains significant. Security professionals are advised to remain vigilant and monitor their environments for unusual activity related to these extensions. 8 sources 67

Extracted Entities

GlassWorm Spreads via 72 Malicious Open VSX Extensions Hidden in Transitive Dependencies

The full story

Extracted Entities

Attack Types (2)

Companies (1)

Malware (1)

MITRE ATT&CK (1)