72 Malicious Open VSX Extensions Linked to GlassWorm Campaign Now Using Transitive Dependencies

Key Takeaways

• The GlassWorm campaign has evolved to use transitive dependencies (extensionPack and extensionDependencies) to deliver malware indirectly via Open VSX.
• Malicious extensions often appear benign initially and introduce malicious dependencies in later updates, bypassing one-time reviews.
• The campaign uses staged JavaScript execution, Russian locale/timezone geofencing, and Solana transaction memos as dead drops.
• Decryption material has been moved from the extension itself to HTTP response headers (ivbase64, secretkey) to evade detection.
• Threat actors inflate download counts and impersonate popular developer utilities, including linters, formatters, and AI tools.

Affected Systems

• VS Code
• Open VSX compatible editors
• Developer workstations

Attack Chain

The threat actor publishes a seemingly benign VS Code extension to the Open VSX registry. In a subsequent update, the extension's manifest is modified to include 'extensionPack' or 'extensionDependencies' pointing to a malicious GlassWorm-linked extension. Once installed, the malicious dependency executes a staged JavaScript loader (extension.js) that performs Russian locale/timezone geofencing and queries Solana transaction memos for dead drop resolution. The loader retrieves follow-on code, decrypts it using keys provided in HTTP response headers, and executes it in-memory via 'eval' or 'vm.Script' to access local credentials and environment secrets.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: Socket

The article mentions that Socket provides dedicated alerts ('VS Code: Extension pack' and 'VS Code: Extension dependency') and tools (Socket GitHub App, CLI, Firewall) to detect and block these malicious transitive relationships, but no raw detection rules are provided.

Detection Engineering Assessment

EDR Visibility: Medium — EDRs can monitor child processes spawned by VS Code, but the primary execution happens in-memory within the Node.js context of the extension host using 'eval' or 'vm.Script', which may evade standard process-level monitoring. Network Visibility: High — The malware relies on external network connections to Solana RPC nodes for dead drop resolution and C2 IPs for payload retrieval, which can be detected via network telemetry. Detection Difficulty: Hard — The use of transitive dependencies means the initial extension appears benign. The malicious payload is heavily obfuscated, executed in-memory, and uses legitimate services (Solana) for dead drops, making static and dynamic analysis challenging.

Required Log Sources

• Network flow logs
• DNS query logs
• Process execution logs (VS Code extension host)

Hunting Hypotheses

Control Gaps

• Static analysis of initial extension releases
• Standard EDR visibility into Node.js 'vm.Script' execution

Key Behavioral Indicators

• Late-version manifest changes adding dependencies
• Russian locale/timezone gating in extension code
• HTTP response headers containing decryption material (ivbase64, secretkey)

False Positive Assessment

• Medium. Legitimate extensions frequently use 'extensionPack' and 'extensionDependencies' for convenience (e.g., language support bundles). Alerting solely on these fields will generate false positives; detection must correlate these fields with suspicious network activity or obfuscated code.

Recommendations

Immediate Mitigation

• Audit extension histories for newly added 'extensionPack' and 'extensionDependencies' relationships.
• Block or remove any GlassWorm-linked packages and infrastructure indicators from developer environments.

Infrastructure Hardening

• Block outbound traffic to known malicious C2 IPs (45.32.150.251, 45.32.151.157, 70.34.242.255).
• Implement network filtering for unexpected Solana RPC node queries from developer workstations.

User Protection

• Review developer workstations for exposed tokens, credentials, config files, and environment secrets.
• Deploy tools that enforce install-time visibility and policy enforcement for VS Code extensions.

Security Awareness

• Educate developers on the risks of transitive dependencies in VS Code extensions.
• Warn developers about extensions impersonating popular tools or inflating download counts.

MITRE ATT&CK Mapping

• T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools
• T1204 - User Execution
• T1480 - Execution Guardrails
• T1059.007 - Command and Scripting Interpreter: JavaScript
• T1027.013 - Obfuscated Files or Information: Encrypted/Encoded File
• T1102.001 - Web Service: Dead Drop Resolver

Additional IOCs

• Ips:
  • 45[.]32[.]150[.]251 - Reused C2 IP
  • 45[.]32[.]151[.]157 - New C2 IP
  • 70[.]34[.]242[.]255 - New C2 IP
• File Paths:
  • extension/out/extension.js - Staged loader location
• Other:
  • BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC - Previous Solana wallet address used as a dead drop
  • MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr - Solana memo program used by the malware
  • c4b9a3773e9dced6015a670855fd32b - Embedded AES IV (hex)
  • aadarkcode.one-dark-material - Malicious Open VSX Extension
  • aligntool.extension-align-professional-tool - Malicious Open VSX Extension
  • angular-studio.ng-angular-extension - Malicious Open VSX Extension
  • awesome-codebase.codebase-dart-pro - Malicious Open VSX Extension
  • awesomeco.wonder-for-vscode-icons - Malicious Open VSX Extension
  • bhbpbarn.vsce-python-indent-extension - Malicious Open VSX Extension
  • blockstoks.easily-gitignore-manage - Malicious Open VSX Extension
  • brategmaqendaalar-studio.pro-prettyxml-formatter - Malicious Open VSX Extension
  • codbroks.compile-runnner-extension - Malicious Open VSX Extension
  • codevunmis.csv-sql-tsv-rainbow - Malicious Open VSX Extension
  • codwayexten.code-way-extension - Malicious Open VSX Extension
  • cosmic-themes.sql-formatter - Malicious Open VSX Extension
  • craz2team.vscode-todo-extension - Malicious Open VSX Extension
  • crotoapp.vscode-xml-extension - Malicious Open VSX Extension
  • cudra-production.vsce-prettier-pro - Malicious Open VSX Extension
  • daeumer-web.es-linter-for-vs-code - Malicious Open VSX Extension (Typosquat of dbaeumer)
  • dark-code-studio.flutter-extension - Malicious Open VSX Extension
  • densy-little-studio.wonder-for-vscode-icons - Malicious Open VSX Extension
  • dep-labs-studio.dep-proffesinal-extension - Malicious Open VSX Extension
  • dev-studio-sense.php-comp-tools-vscode - Malicious Open VSX Extension
  • devmidu-studio.svg-better-extension - Malicious Open VSX Extension
  • dopbop-studio.vscode-tailwindcss-extension-toolkit - Malicious Open VSX Extension
  • errlenscre.error-lens-finder-ex - Malicious Open VSX Extension
  • exss-studio.yaml-professional-extension - Malicious Open VSX Extension
  • federicanc.dotenv-syntax-highlighting - Malicious Open VSX Extension
  • flutxvs.vscode-kuberntes-extension - Malicious Open VSX Extension
  • gvotcha.claude-code-extension - Malicious Open VSX Extension
  • gvotcha.claude-code-extensions - Malicious Open VSX Extension
  • intellipro.extension-json-intelligence - Malicious Open VSX Extension
  • kharizma.vscode-extension-wakatime - Malicious Open VSX Extension
  • ko-zu-gun-studio.synchronization-settings-vscode - Malicious Open VSX Extension
  • kwitch-studio.auto-run-command-extension - Malicious Open VSX Extension
  • lavender-studio.theme-lavender-dreams - Malicious Open VSX Extension
  • littensy-studio.magical-icons - Malicious Open VSX Extension
  • lyu-wen-studio-web-han.better-formatter-vscode - Malicious Open VSX Extension
  • markvalid.vscode-mdvalidator-extension - Malicious Open VSX Extension
  • mecreation-studio.pyrefly-pro-extension - Malicious Open VSX Extension
  • mswincx.antigravity-cockpit - Malicious Open VSX Extension
  • mswincx.antigravity-cockpit-extension - Malicious Open VSX Extension
  • namopins.prettier-pro-vscode-extension - Malicious Open VSX Extension
  • oigotm.my-command-palette-extension - Malicious Open VSX Extension
  • otoboss.autoimport-extension - Malicious Open VSX Extension
  • ovixcode.vscode-better-comments - Malicious Open VSX Extension
  • pessa07tm.my-js-ts-auto-commands - Malicious Open VSX Extension
  • potstok.dotnet-runtime-extension - Malicious Open VSX Extension
  • pretty-studio-advisor.prettyxml-formatter - Malicious Open VSX Extension
  • prismapp.prisma-vs-code-extension - Malicious Open VSX Extension
  • projmanager.your-project-manager-extension - Malicious Open VSX Extension
  • pubruncode.ccoderunner - Malicious Open VSX Extension
  • pyflowpyr.py-flowpyright-extension - Malicious Open VSX Extension
  • pyscopexte.pyscope-extension - Malicious Open VSX Extension
  • redcapcollective.vscode-quarkus-elite-suite - Malicious Open VSX Extension
  • rubyideext.ruby-ide-extension - Malicious Open VSX Extension
  • runnerpost.runner-your-code - Malicious Open VSX Extension
  • shinypy.shiny-extension-for-vscode - Malicious Open VSX Extension
  • sol-studio.solidity-extension - Malicious Open VSX Extension
  • ssgwysc.volar-vscode - Malicious Open VSX Extension
  • studio-jjalaire-team.professional-quarto-extension - Malicious Open VSX Extension
  • studio-velte-distributor.pro-svelte-extension - Malicious Open VSX Extension
  • sun-shine-studio.shiny-extension-for-vscode - Malicious Open VSX Extension
  • sxatvo.jinja-extension - Malicious Open VSX Extension
  • tamokill12.foundry-pdf-extension - Malicious Open VSX Extension
  • thing-mn.your-flow-extension-for-icons - Malicious Open VSX Extension
  • tima-web-wang.shell-check-utils - Malicious Open VSX Extension
  • tokcodes.import-cost-extension - Malicious Open VSX Extension
  • toowespace.worksets-extension - Malicious Open VSX Extension
  • treedotree.tree-do-todoextension - Malicious Open VSX Extension
  • tucyzirille-studio.angular-pro-tools-extension - Malicious Open VSX Extension
  • turbobase.sql-turbo-tool - Malicious Open VSX Extension
  • twilkbilk.color-highlight-css - Malicious Open VSX Extension
  • vce-brendan-studio-eich.js-debuger-vscode - Malicious Open VSX Extension
  • yamaprolas.revature-labs-extension - Malicious Open VSX Extension