Skip to content
GlassWorm Malware: First Self-Propagating Worm for VS Code Extensions

GlassWorm Malware: First Self-Propagating Worm for VS Code Extensions

First seen 23 Oct 2026, 14:07 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 15:14 UTC
  • •GlassWorm is the first self-propagating worm targeting VS Code extensions.
  • •At least 35,800 installations have been compromised, with ongoing exploitation confirmed.
  • •The malware uses advanced techniques like invisible code injection and blockchain for C2.

In October 2025, Koi Security discovered GlassWorm, a self-propagating worm targeting Visual Studio Code extensions on OpenVSX and Microsoft marketplaces. The malware has compromised at least 35,800 installations, utilizing invisible code injection techniques to evade detection. GlassWorm operates by stealing NPM tokens, GitHub credentials, and OpenVSX access tokens to infect additional packages autonomously. It employs the Solana blockchain for its command and control infrastructure, making it difficult to dismantle. The malware's unique capabilities signify a significant evolution in supply chain attacks, with ongoing concerns about its impact on developers. Current reports indicate that the malware remains active and poses a serious threat to the developer community.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-10-17
Seven Open VSX extensions compromised
Koi Security reported that seven extensions were infected, leading to widespread installations of GlassWorm.
2-Spyware
2025-10-21
GlassWorm entry listed on ThreatFox
The abuse.ch project ThreatFox documented the first entry of GlassWorm malware.
2-Spyware
2026-10-23
Current reports highlight ongoing threat
Both Veracode and 2-Spyware confirm that GlassWorm remains a significant threat to developers.
Veracode

More articles in this cluster (3)

Following this threat?

Track Glassworm and Eclipse Foundation in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (18)

1 / 3

Common questions

What systems are affected by GlassWorm?
GlassWorm targets Visual Studio Code extensions on both OpenVSX and Microsoft VSCode marketplaces.
How does GlassWorm propagate?
It steals credentials from infected systems to compromise additional packages and extensions autonomously.
What should developers do to protect themselves?
Developers should review their installed extensions and monitor for any suspicious activity related to their credentials.