Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack

Back Feeds.Feedburner

Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack

Feeds.Feedburner •Ionut Arghire • February 2, 2026

Share: View original

A hacker published malicious versions of four established VS Code extensions to distribute a GlassWorm malware loader.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malware Campaign Targets Open VSX Extension with 5,066 Downloads A sophisticated malware campaign has compromised the Open VSX extension marketplace, affecting over 5,000 developer workstations. The malicious package masqueraded as a legitimate Angular Language Service extension, embedding encrypted malware that activates upon opening HTML or TypeScript files. The attack utilized typosquatting and steganography techniques to evade detection. 20 sources 37

Extracted Entities

Attack Types (1)

Campaigns (1)

Fresh GlassWorm Attack

Companies (1)

Open VSX Publisher

Malware (1)

Tools (1)