Minacce e avversari · Supply chain
Sleeper Extensions Turn Open VSX Into Malware Delivery Benign-looking extension clones can be a delayed compromise, not a clean install. The standard response of checking the first publish is not enough, because these packages are seeded under fresh accounts and only later updated to deliver malware through the normal update path.
Socket is tracking 73 impersonation extensions tied to GlassWorm on Open VSX. At least six have already been activated to deliver malware, and the wider campaign also compromised Bitwarden CLI 2026.4.0 through a GitHub Action in Bitwarden’s CI/CD pipeline.
The risk is persistence through trust. Once a sleeper extension is installed, later updates can turn it into a delivery vehicle at scale without an obvious initial warning.
5 fonti · 28 apr
Cronologia Fonti 28 apr CSO Online
More fake extensions linked to GlassWorm found in Open VSX code marketplace
73 new phony extensions added this month, say researchers at Socket, as the supply chain attacks continue.
originale 28 apr Dark Reading
Fresh Wave of GlassWorm VS Extensions Slices Through Supply Chain
Attackers continue to scale a campaign to seed Open VSX with seemingly benign VS Code extensions that spread self-propagating malware.
originale 28 apr SecurityWeek
Dozens of Open VSX Extension Clones Linked to GlassWorm Malware
Over 70 cloned Open VSX extensions are likely sleeper extensions designed to distribute malware.
originale Part of the PlainSec briefing for 2026-04-29
Every edition of this story: Sleeper Extensions Turn Open VSX Into Malware Delivery
Altro da oggi Minacce e avversari · Supply chain
Sleeper Extensions Turn Open VSX Into Malware Delivery Benign-looking extension clones can be a delayed compromise, not a clean install. The standard response of checking the first publish is not enough, because these packages are seeded under fresh accounts and only later updated to deliver malware through the normal update path.
Socket is tracking 73 impersonation extensions tied to GlassWorm on Open VSX. At least six have already been activated to deliver malware, and the wider campaign also compromised Bitwarden CLI 2026.4.0 through a GitHub Action in Bitwarden’s CI/CD pipeline.
The risk is persistence through trust. Once a sleeper extension is installed, later updates can turn it into a delivery vehicle at scale without an obvious initial warning.
5 fonti · 28 apr
Cronologia Fonti 28 apr CSO Online
More fake extensions linked to GlassWorm found in Open VSX code marketplace
73 new phony extensions added this month, say researchers at Socket, as the supply chain attacks continue.
originale 28 apr Dark Reading
Fresh Wave of GlassWorm VS Extensions Slices Through Supply Chain
Attackers continue to scale a campaign to seed Open VSX with seemingly benign VS Code extensions that spread self-propagating malware.
originale 28 apr SecurityWeek
Dozens of Open VSX Extension Clones Linked to GlassWorm Malware
Over 70 cloned Open VSX extensions are likely sleeper extensions designed to distribute malware.
originale Part of the PlainSec briefing for 2026-04-29
Every edition of this story: Sleeper Extensions Turn Open VSX Into Malware Delivery
Altro da oggi