Threats · 181 days ago
GlassWorm operators deployed 72 malicious Open VSX extensions to target developers. Researchers found 151 infected GitHub repositories and say attackers abused extensionPack and extensionDependencies to make trusted extensions pull malicious payloads.
3 sources covering this story
GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX
The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, repositories, and extensions on GitHub, npm, and VSCode/OpenVSX extensions.
GlassWorm Malware Evolves to Hide in Dependencies
Dozens of updated, malicious GlassWorm extensions have infested Open VSX, threatening software development supply chains.
GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers
GlassWorm campaign used 72 malicious Open VSX extensions and infected 151 GitHub repositories, enabling stealth supply-chain attacks on developers.
Part of the PlainSec briefing for 2026-03-15