Threats & Adversaries · Supply Chain
GlassWorm operators deployed 72 malicious Open VSX extensions to target developers. Researchers found 151 infected GitHub repositories and say attackers abused extensionPack and extensionDependencies to make trusted extensions pull malicious payloads.
3 sources · Mar 17
BleepingComputer
GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX
The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, repositories, and extensions on GitHub, npm, and VSCode/OpenVSX extensions.
originalDark Reading
GlassWorm Malware Evolves to Hide in Dependencies
Dozens of updated, malicious GlassWorm extensions have infested Open VSX, threatening software development supply chains.
originalThe Hacker News
GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers
GlassWorm campaign used 72 malicious Open VSX extensions and infected 151 GitHub repositories, enabling stealth supply-chain attacks on developers.
originalPart of the PlainSec briefing for 2026-03-15
Every edition of this story: GlassWorm Uses Open VSX Extensions to Target Developers