GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers

Summary

The GlassWorm campaign has escalated by abusing Open VSX registry extensions, turning them into delivery vehicles. Researchers discovered 72 new malicious extensions mimicking developer tools. This iteration uses heavier obfuscation and rotates Solana wallets to evade detection.

Key Takeaways

1. Cybersecurity researchers have flagged a new iteration of the GlassWorm campaign that they say represents a "significant escalation" in how it propagates through the Open VSX registry.
2. The software supply chain security company said it discovered at least 72 additional malicious Open VSX extensions since January 31, 2026, targeting developers.
3. GlassWorm is the name given to an ongoing malware campaign that has repeatedly infiltrated Microsoft Visual Studio Marketplace and Open VSX with malicious extensions designed to steal secrets and drain cryptocurrency wallets, and abuse infected systems as proxies for other criminal activities.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents detailed technical information about a cybersecurity threat, citing specific researchers and companies. It includes verbatim quotes and lists affected extensions. The information is presented factually, with a focus on technical analysis rather than sensationalism.

Bias assessment: Technical Security Reporting. The article focuses on reporting technical details of a cybersecurity attack. While it highlights the severity of the threat, it maintains an objective tone and avoids partisan language or emotional appeals. The primary lens is that of technical analysis and threat intelligence.

Note: This article provides in-depth technical details on a cybersecurity threat. While credible, users should independently verify specific claims and technical implementations.

Credibility flag: Technical, Verify Claims

Claimed Facts (8)

• This is a direct quote from a security company detailing a specific technical method used in the attack.
• This states a specific number of discovered malicious extensions and a timeframe, presented as a factual finding.
• This describes the nature of the malicious extensions, providing concrete examples of what they impersonate.
• This states an action taken by Open VSX in response to the discovered threats.
• This provides historical context and specific dates for the identification of similar tactics.
• This details specific technical characteristics of the latest GlassWorm iteration.
• This provides a specific number of affected repositories and a timeframe for the campaign's activity.
• This states the deployment of a specific technique across multiple platforms, indicating a coordinated effort.

Opinions (6)

• The phrase 'significant escalation' is an interpretation of the threat's impact by the researchers, not a directly measurable fact.
• While reporting a discovery, the framing of 'development comes as' suggests a narrative connection that is interpretive.
• The phrase 'come with functionality to steal' implies intent and capability, which is an interpretation of the code's purpose.
• The phrase 'stands out for' is a subjective assessment of the activity's distinctiveness.
• The phrase 'a claim it challenged' indicates a dispute and skepticism, which is an opinionated stance.
• The phrase 'certainly welcome' and 'highlights the risks' are subjective evaluations of the situation.

Claims (5)

• This statement is subjective ('obviously suspicious') and lacks concrete evidence to support the claim that malicious injections are not obvious.
• This is a strong assertion ('strongly suggests') about the attackers' methods (using LLMs) without direct proof, making it a speculative claim.
• The claim that libraries collect 'far more information than necessary' is subjective and lacks specific metrics for 'necessary'. 'No transparency' is also a strong, potentially absolute claim.
• While the article lists types of data, the absolute claim of 'functionality to steal' without detailing the mechanism or success rate can be considered a strong, potentially unsubstantiated claim.
• The challenge to the 'legitimate experiment' claim is based on 'red flags' which are not fully detailed or substantiated within the text, making the challenge itself a dubious claim without further evidence.

Key Sources

• Ravie Lakshmanan — Author
• The Hacker News — Media
• Socket — Software supply chain security company
• Koi Security — Security firm
• Aikido — Security company
• Ilyas Makari — Security researcher
• Endor Labs — Application security company