Bleepingcomputer

GlassWorm Malware Resurfaces in Open VSX and GitHub

First seen 17 Nov 2025, 19:15 UTC • •25.0

Article Content

1 / 7

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

GlassWorm malware has reappeared on the Open VSX registry and in GitHub repositories, infecting three additional VS Code extensions. This resurgence follows its removal from the official marketplace, as reported by Koi Security researchers.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 218d ago How this analysis works

Threat Graph

12 entities, 12 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
Supply Chain Attack

Campaign (1)

Glassworm Campaign

Organization (3)

OpenVSX
Open VSX
Open VSX Registry

Malware (1)

Glassworm

Affected Platform (3)

GitHub
Solana
Visual Studio Code

Tool (2)

Npm
RedExt

Relationships

Glassworm Campaign uses Glassworm
Glassworm targets OpenVSX
Glassworm targets Open VSX
Glassworm targets Open VSX Registry
Malware targets GitHub
Malware targets Solana
Malware targets Visual Studio Code
Supply Chain Attack targets GitHub
Supply Chain Attack targets Solana
Supply Chain Attack targets Visual Studio Code
Glassworm Campaign related to Npm
Glassworm Campaign related to RedExt

Following this threat?

Track Glassworm and OpenVSX in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

GlassWorm Campaign Targets Developers with Malicious VS Code Extensions A cluster of malicious Visual Studio Code extensions linked to the GlassWorm threat actor was uncovered, affecting thousands of developers. These extensions, disguised as color themes, contain obfuscated JavaScript loaders that can retrieve secondary payloads. The Socket Threat Research team identified two confirmed…

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

+6 86

GlassWorm Malware Resurfaces in Open VSX and GitHub

Article Content

More articles in this cluster (6)

Threat Graph

Following this threat?

Extracted Entities (12)

Attack Types (2)

Campaigns (1)

Companies (3)

Malware (1)

Platforms (3)

Tools (2)

Continue Reading