🕵️ GlassWorm

The items that name it 16

• OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found
  writeupas classification.key entities2026-10-24
• Software supply chain security best practices for 2026
  articleas classification.key entities2026-10-21
• The OpenSourceMalware Show #26
  talkas classification.key entities2026-10-21
• Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
  articleas classification.key entities2026-10-21
• Glassworm Hacks OVH Clouds CLI tool
  writeupas classification.key entities2026-10-19
• Introducing Socket Scanning for VS Code Marketplace Extensions
  articleas threat actors2026-10-06

  Threat cluster uncovered by Socket's threat research team spanning four VS Code Marketplace extensions and six Open VSX extensions, including two confirmed malicious extensions; used encrypted JavaScript and a Solana dead drop to locate and execute additional payloads via a malicious color theme ext

• Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX
  writeupas threat actors2026-10-02

  Developer-targeting supply chain campaign known for abusing extension ecosystems (VS Code Marketplace, Open VSX) to steal credentials, session data, cryptocurrency wallets, and developer authentication artifacts. Uses AES-256-CBC encrypted loaders, Russian-language/timezone gating, and Solana transa

• OpenSourceMalware Blog
  articleas threat actors2026-07-18

  Attack compromised 430+ GitHub projects leveraging four different ecosystems; infrastructure later taken down by Crowdstrike.

• The OpenSourceMalware Show #12
  talkas threat actors2026-07-09

  Malware/campaign referenced as the 'flagship example' of obfuscation tricks in Open VSX malicious extensions; a V2 was detected by Socket in April. Cited via report: 'GlassWorm: Open VSX Transitive Dependency Supply-Chain Escalation'. Mikael Barbero notes Open VSX added detection for GlassWorm-style

• The OpenSourceMalware Show #10
  talkas threat actors2026-06-25
• Socket: Firewall Now Blocks Malicious VS Code and Open VSX Extensions
  articleas threat actors2026-06-18

  Malware/campaign documented by Socket researchers involving repeated attacks across Open VSX, using malicious and compromised extensions to steal developer credentials and spread through trusted editor marketplaces.

• Multiple JetBrains IDE plugins caught stealing AI keys
  writeupas threat actors2026-06-16

  Ongoing campaign targeting VS Code, cited as an example of editor plugin ecosystem supply chain attacks.

• Socket: GlassWASM
  writeupas threat actors2026-06-16

  Supply-chain campaign developer/malware family; between roughly November 2025 and March 2026 compromised 400+ components across npm, VS Code Marketplace, Open VSX, and GitHub. Defining innovation: Solana transaction memos to a watched wallet as takedown-resistant C2 dead-drop resolving a rotating se

• Open Source Malware Podcast — episodes
  otheras threat actors2026-05-22

  Malware infrastructure taken down by Crowdstrike

• JFrog: The Governance Gap Between Your Policy and Your Pipeline
  articleas classification.key entities2026-05-21
• Socket: 73 Open VSX Sleeper Extensions Linked to GlassWorm
  writeupas threat actors2026-05-06

  Campaign targeting Open VSX with impersonation/sleeper extensions that activate to deliver malware via extension update paths, extensionPack transitive delivery, native binaries, and obfuscated JavaScript loaders; uses Solana transaction memos as a dead-drop channel for runtime payload retrieval.