Trojanized OpenVSX Extension Spreads GlassWorm Across VS Code, Cursor, and Windsurf

Cybersecuritynews •Tushar Subhra Dutta • April 10, 2026

A fake developer extension published on the OpenVSX marketplace is silently spreading a known malware strain called GlassWorm to every code editor installed on a developer’s machine. The malicious package disguises itself as a legitimate productivity tool and uses a compiled native binary to quietly infect VS Code, Cursor, Windsurf, and several other editors all […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GlassWorm Malware Exploits OpenVSX Extension to Infect Multiple IDEs A malicious extension named code-wakatime-activity-tracker has been identified on the OpenVSX marketplace, designed to spread the GlassWorm malware across multiple integrated development environments (IDEs) including VS Code, Cursor, and Windsurf. This extension masquerades as a legitimate productivity tool, utilizing a Zig-compiled native binary to stealthily install a malicious .vsix package into every compatible IDE found on the victim's machine. The attack targets all IDEs that support the VS Code extension format, significantly broadening its impact. The malware was first discovered in March 2025 and has evolved to include this new method of infection. The native binaries provide the malware with OS-level access, allowing it to operate outside the JavaScript sandbox. Developers using affected IDEs are at risk of having their systems compromised, with the potential for data theft and further exploitation. The situation remains critical as the malware continues to spread through this new vector. 3 sources 65

Extracted Entities

Trojanized OpenVSX Extension Spreads GlassWorm Across VS Code, Cursor, and Windsurf

The full story

Extracted Entities

Attack Types (2)

Companies (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (2)

Tools (1)