Glassworm Malware Hits OpenVSX and Microsoft Visual Studio Platforms with 24 New Packages

The Glassworm malware campaign has resurfaced with unprecedented scale, deploying 24 malicious extensions across Microsoft Visual Studio Marketplace and OpenVSX over the past week.

This latest wave of attacks demonstrates the persistent threat posed by supply chain compromises targeting developer tools.

The malware specifically clones legitimate extensions for popular frameworks, including Flutter, Tailwind, Vim, Yaml, Svelte, React Native, and Vue, making it difficult for developers to distinguish between authentic and fraudulent packages.

The attack mechanism exploits the trust developers place in extension marketplaces by initially publishing seemingly legitimate packages that pass security reviews.

Once approved, the extensions receive updates containing hidden malicious code, allowing the attackers to bypass existing security filters.

Secure Annex security researchers identified that these malicious extensions employ sophisticated techniques to manipulate download counts and artificially inflate installation statistics, positioning the fake extensions directly alongside legitimate ones within the IDE interface.

This social engineering tactic makes it challenging for users to identify the correct extension during installation.

Infection Mechanism and Evolution

The infection process begins when developers install what appears to be a legitimate extension from the marketplace.

The malicious payload activates immediately after the extension loads into the development environment. Once activated, the code executes embedded implants that were previously hidden within the extension package.

The attackers have evolved their evasion tactics significantly, transitioning from invisible Unicode characters in earlier iterations to Rust-based implants embedded directly inside the extensions.

When the extension activates, it runs the malicious code within the developer’s system context, giving attackers access to sensitive information such as environment variables, authentication tokens, and project source code.

The sophisticated obfuscation techniques make detection difficult without specialized security analysis tools. Secure Annex analysts noted the consistent attack signatures and patterns across the campaigns, linking various techniques together despite their evolution.

The researchers discovered that many extensions continue staging operations while manipulating download statistics to build credibility before final deployment.

The identified compromised packages span both marketplaces, with notable examples including prisma-inc.prisma-studio-assistance, prettier-vsc.vsce-prettier, and flutter-extension across both platforms.

Organizations using these extensions face significant risk from unauthorized system access and data exfiltration.

Security professionals recommend immediately auditing installed extensions and implementing marketplace scanning solutions to detect and prevent future compromises.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.