Skip to content

Back to the catalog

Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX
socket.devwriteup

Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX

Socket's Threat Research team uncovered a theme-extension cluster spanning four VS Code Marketplace and six Open VSX listings, including two confirmed malicious extensions: Aurora Nocturne Night Theme (a Windows downloader that fetches and silently executes temp_batch.cmd via cmd.exe from fingercakes4sale[.]store, tied to XWorm C2 infrastructure) and Cosmic Nebula Themes, whose app.js decrypts an AES-256-CBC embedded stage and uses a Solana transaction memo as a dead-drop to resolve follow-on payload infrastructure — the same AES key, Solana address, and execution model previously documented in GlassWorm activity. Git commit identities, near-identical theme source, shared Russian-language developer comments, and brandjacking (Coca-Cola, Aurora Borealis name-squatting) link the cluster together; a Dec 14, 2025 DEV Community article is assessed as promotional infrastructure driving Open VSX installs. The post provides full IOCs (hashes, domains, Solana address, AES key/IV, GitHub accounts) and MITRE ATT&CK mappings for defenders to hunt and inventory extensions across both registries.

TL;DR Socket links a cluster of malicious VS Code/Open VSX theme extensions — including one confirmed GlassWorm variant using AES decryption and a Solana dead-drop — via shared git history, code fingerprints, and brandjacking.
Open original ↗
Document

What it is

The GlassWorm-linked VS Code theme cluster spans four Visual Studio Marketplace and six Open VSX extension identities. Two confirmed malicious payloads anchor the cluster: Aurora Nocturne Night Theme (microsoftvs.microsoftvs) and Cosmic Nebula Themes (cosmic-themes.theme-cosmic-nebula). Microsoft removed Cosmic Nebula Themes from the Marketplace and classified it as malware.

How it works

Aurora Nocturne Night Theme ships a benign app.js on GitHub but distributes a different, obfuscated out/extension.js (~59KB, zero-width-Unicode-encoded payload) via activationEvents: ["*"]. Decoded, it uses Node's https/fs/child_process to fetch content from fingercakes4sale[.]store/dsyuC, write it to %TEMP%\temp_batch.cmd, and run it via cmd /c with windowsHide: true. Public sandbox telemetry ties that domain's resolved IP (173.232.146.211) to a chain that also pulls WDS.bat from mountaingoats4sale[.]xyz, classified by Hatching Triage as XWorm RAT with C2 at 45.157.233.46:25565, persisting via a hidden scheduled task.

Cosmic Nebula Themes' app.js decrypts an embedded stage with AES-256-CBC (key wDO6YyTm6DL0T0zJ0SXhUql5Mo0pdlSz, IV 4c4b9a3773e9dced6015a670855fd32b) and eval()s it. That stage skips Russian-locale/timezone systems, queries Solana address BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC for a transaction memo, base64-decodes a next-stage URL from the memo JSON, fetches it (sending os: os.platform()), and runs the response in a vm.createContext with require/Buffer/process exposed — identified via response headers ivbase64 and secretkey. This Solana-memo dead-drop, AES key, and execution model match previously documented GlassWorm infrastructure, giving high-confidence attribution. The cosmic-themes publisher namespace was also behind a separately confirmed GlassWorm extension (cosmic-themes.sql-formatter).

Development links: git commits from aubineherodvulbdl@outlook[.]com and lohsebhipolg2s@outlook[.]com connect Aurora Nocturne, Aurora Borealis Studio Theme, and Coca-Cola Christmas, with five related commits occurring within ~3 hours on Dec 6, 2025 at matching UTC-08:00 offsets. A Dec 14, 2025 DEV Community article (posted same day its author account was created) is assessed as promotional infrastructure driving Open VSX installs of Deep Focus, Aurora Borealis, Charcoal Mint, and Cosmic Nebula.

Preconditions / Affected

Affects VS Code Marketplace and Open VSX, plus any VS Code-compatible editor consuming those registries. Live, currently non-weaponized cluster members at time of writing: Coca-Cola Christmas and Aurora Borealis Studio Theme (8,000+ Marketplace installs combined); Open VSX cluster extensions had tens of thousands of downloads, including ~10,000 for Charcoal Mint Co. alone.

What to do

  • Hunt for fingercakes4sale[.]store, %TEMP%\temp_batch.cmd, and cmd.exe spawned from VS Code/extension host; treat hosts where the batch ran as potentially compromised.
  • For Cosmic Nebula Themes installs, investigate follow-on execution under developer privileges and rotate potentially exposed credentials.
  • Inventory extensions (including themes) across both registries; inspect package.json, entrypoints, activation events, bundled JS, network/process calls, and runtime decryption — don't trust the public GitHub source over the distributed artifact.
  • Detect via: runtime-decrypted JS, Russian locale/timezone gating, Solana memo lookups, the specific dead-drop address above, ivbase64/secretkey headers, and remotely-supplied JS executed with Node capabilities.
  • MITRE mapping provided: T1195.002, T1027, T1140, T1105, T1102.001, T1059.007, T1059.003, T1614.001.

Caveats

A May 26, 2026 coordinated takedown (CrowdStrike, Google, Shadowserver) disrupted GlassWorm C2 but did not remove already-published extensions or eliminate footholds; Socket notes subsequent GlassWorm activity has continued with new delivery techniques and rotated infrastructure. Not every cluster-linked identity was confirmed to carry an active payload — several are included as association-based pivots rather than confirmed malware.

Organisations named here

  • fingercakes4sale[.]store
  • mountaingoats4sale[.]xyz
  • T1027
  • T1059.003
  • T1059.007
  • T1102.001
  • T1105
  • T1140
  • T1195.002
  • T1614.001

Technologies named here

  • Visual Studio Code Marketplace
  • Socket
  • Open VSX Registry
  • Hatching Triage
  • Aurora Nocturne Night Theme
  • Public malware sandbox telemetry
  • Coca-Cola Christmas
  • Aurora Borealis Studio Theme
  • Cosmic Nebula Themes
  • Aurora Nocturne Dreams Theme
  • Solidity syntax | Rust syntax
  • Theme Charcoal Mint Co.
  • cosmic-themes.sql-formatter
  • mister-gold.aurora-borealis-theme
  • Windows
  • VS Code
  • Open VSX
  • Solana
  • Node.js
  • PowerShell

Techniques named here

  • Supply chain compromise
  • Obfuscated Files or Information
  • Deobfuscate/Decode Files or Information
  • Ingress Tool Transfer
  • Web Service
  • Command and Scripting Interpreter
  • System Location Discovery

Threat actors named here

  • GlassWorm
  • XWorm
  • Theme cluster

Related in Supply Chain