GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers
The GlassWorm campaign has seen a substantial escalation in its propagation through the Open VSX registry, according to cybersecurity researchers who have identified a new version of the campaign.
The threat actor is now abusing extensionPack and extensionDependencies to transform initially standalone-looking extensions into transitive delivery vehicles in subsequent updates, rather than requiring every malicious listing to embed the loader directly. This allows a benign-looking package to start pulling a separate GlassWorm-linked extension only after trust has been established, according to a report released by Socket on Friday.
Since January 31, 2026, at least 72 more malicious Open VSX extensions that target developers have been found, according to the software supply chain secur...