Socket: 73 Open VSX Sleeper Extensions Linked to GlassWorm

What it is

Socket's tracking of a new GlassWorm cluster on the Open VSX marketplace: 73 impersonation extensions cloning popular code extensions, of which at least six have been activated to deliver malware and the rest are assessed as high-confidence sleepers. It follows a March 2026 wave of 72 malicious Open VSX extensions tied to the same campaign.

How it works

Threat actors publish benign clones that build download counts and trust, then weaponize them later via the normal extension update path. Delivery has moved off the extension source itself: activated versions declare an extensionPack (or extensionDependencies) entry that transitively pulls a separate malicious component. In the April 29 wave, 17 of the new versions pointed at blockstoks.easily-gitignore-manage. Other observed channels include VSIX payloads hosted on GitHub and, in earlier variants, Solana transaction memos used as a dead-drop for encoded second-stage payloads fetched and executed in memory.

Preconditions / Affected

Anyone installing extensions from Open VSX (VS Code forks, Cursor, VSCodium, Gitpod, etc.). The social-engineering hook is visual: clones copy the icon, name, description, and README of a legitimate extension — e.g., Emotionkyoseparate.turkish-language-pack mimicking the real MS-CEINTL.vscode-language-pack-tr (150K downloads). The tell is the publisher namespace and low download count, differences subtle enough to miss when browsing quickly.

What to do

Concrete detection heuristics the page supplies:

• Treat extensions published by newly created GitHub accounts with only one or two public repositories, where one repo is empty and named with an eight-character string, as suspect — this is the consistent authorship fingerprint across the cluster.
• Verify the publisher namespace matches the expected vendor (e.g., MS-CEINTL), not just the icon/name/description.
• Flag any extension whose extensionPack / extensionDependencies reference an unfamiliar utility extension as a transitive-delivery vector.
• Cross-reference against Socket's tracked list on their GlassWorm v2 page: https://socket.dev/supply-chain-attacks/glassworm-v2

Caveats

The counts are provisional — Socket says the total may change as updates continue. One notable operational detail: the pull target blockstoks.easily-gitignore-manage was disclosed March 13, 2026 and removed from Open VSX on April 27 — ~52 hours before the activation wave referenced it, so those extensionPack references were dead on arrival. Socket reads this as evidence the activation pipeline is automated and does not validate puller liveness against the marketplace before publishing host updates — meaning removal of a payload host does not stop the actor from shipping activations, and future waves may point at live hosts.