Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware
Numerous Microsoft Visual Studio Code (VS Code) extensions that are connected to a persistent information-stealing campaign known as GlassWorm have been identified by cybersecurity experts on the Open VSX repository.
It has been determined that the 73 extensions in the cluster are clones of their original counterparts. Six of them have been proven to be harmful, while the others function as seemingly innocuous sleeper programs to entice users to download them and gain their trust before a later update reveals their true goal.
According to application security firm Socket, which is monitoring the most recent version under the name GlassWorm v2, all of the extensions were released at the beginning of the month. Since December 21, 2025, over 320 items have been found. Below is a list o...