Bleepingcomputer

GlassWorm Malware Resurfaces in Open VSX and GitHub

First seen 17 Nov 2025, 19:15 UTC • Bleepingcomputer

•25.0

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

GlassWorm malware has reappeared on the Open VSX registry and in GitHub repositories, infecting three additional VS Code extensions. This resurgence follows its removal from the official marketplace, as reported by Koi Security researchers.

How this analysis works

Attack Flow

19 entities, 27 inferred relationships (STIX 2.1).

Technique (3)

Malware
Supply Chain Attack
Worm

Campaign (1)

Glassworm Campaign

Organization (3)

OpenVSX
Open VSX
Open VSX Registry

Indicator (1)

ai-driven-dev.ai

Malware (2)

Glassworm
Shai Hulud

Affected Platform (7)

GitHub
Google Calendar
Open-VSX Marketplace
Solana
Solana Blockchain
Visual Studio Code
Visual Studio Code Marketplaces

Tool (2)

Npm
RedExt

Relationships

Glassworm communicates with ai-driven-dev.ai
Shai Hulud communicates with ai-driven-dev.ai
Glassworm Campaign uses Glassworm
Glassworm Campaign uses Shai Hulud
Glassworm targets OpenVSX
Glassworm targets Open VSX
Glassworm targets Open VSX Registry
Shai Hulud targets OpenVSX
Shai Hulud targets Open VSX
Shai Hulud targets Open VSX Registry
Malware targets GitHub
Malware targets Google Calendar
Malware targets Open-VSX Marketplace
Malware targets Solana
Supply Chain Attack targets GitHub
Supply Chain Attack targets Google Calendar
Supply Chain Attack targets Open-VSX Marketplace
Supply Chain Attack targets Solana
Worm targets GitHub
Worm targets Google Calendar
Worm targets Open-VSX Marketplace
Worm targets Solana
Glassworm Campaign related to Solana Blockchain
Glassworm Campaign related to Visual Studio Code
Glassworm Campaign related to Visual Studio Code Marketplaces
Glassworm Campaign related to Npm
Glassworm Campaign related to RedExt

Continue Reading

MuddyWater Targets U.S. Entities Amid Geopolitical Tensions Glassworm Malware Targets React Native npm Packages in Supply Chain Attack GlassWorm Malware Campaign Targets OpenVSX with 73 Malicious Extensions Malicious JetBrains Plugins Exfiltrate AI API Keys from Developers Glassworm Botnet Targeting Developers Disrupted by CrowdStrike and Google Armored Likho Expands Cyber-Espionage with New Rust Toolkit

GlassWorm Malware Resurfaces in Open VSX and GitHub

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading