Skip to content
.ca
sign in
8 minhigh

72 Malicious Open VSX Extensions Linked to GlassWorm Campaign Now Using Transitive Dependencies

The GlassWorm threat actor has evolved its supply chain attack methodology by abusing VS Code extension manifest fields to transitively deliver malicious payloads. This technique allows initially benign extensions to pull in malicious dependencies during later updates, executing staged JavaScript loaders that target developer workstations for credential and secret theft.

Sens:■ ImmediateConf:highAnalyzed:2026-03-16reports
ActorsGlassWorm
Malicious ExtensionsGlassWormSupply ChainVS CodeOpen VSX

Source:Socket

IOCs · 1

Key Takeaways

  • The GlassWorm campaign has evolved to use transitive dependencies (extensionPack and extensionDependencies) to deliver malware indirectly via Open VSX.
  • Malicious extensions often appear benign initially and introduce malicious dependencies in later updates, bypassing one-time reviews.
  • The campaign uses staged JavaScript execution, Russian locale/timezone geofencing, and Solana transaction memos as dead drops.
  • Decryption material has been moved from the extension itself to HTTP response headers (ivbase64, secretkey) to evade detection.
  • Threat actors inflate download counts and impersonate popular developer utilities, including linters, formatters, and AI tools.

Affected Systems

  • VS Code
  • Open VSX compatible editors
  • Developer workstations

Attack Chain

The threat actor publishes a seemingly benign VS Code extension to the Open VSX registry. In a subsequent update, the extension's manifest is modified to include 'extensionPack' or 'extensionDependencies' pointing to a malicious GlassWorm-linked extension. Once installed, the malicious dependency executes a staged JavaScript loader (extension.js) that performs Russian locale/timezone geofencing and queries Solana transaction memos for dead drop resolution. The loader retrieves follow-on code, decrypts it using keys provided in HTTP response headers, and executes it in-memory via 'eval' or 'vm.Script' to access local credentials and environment secrets.

Detection Availability

  • YARA Rules: No
  • Sigma Rules: No
  • Snort/Suricata Rules: No
  • KQL Queries: No
  • Splunk SPL Queries: No
  • EQL Queries: No
  • Other Detection Logic: No
  • Platforms: Socket

The article mentions that Socket provides dedicated alerts ('VS Code: Extension pack' and 'VS Code: Extension dependency') and tools (Socket GitHub App, CLI, Firewall) to detect and block these malicious transitive relationships, but no raw detection rules are provided.

Detection Engineering Assessment

EDR Visibility: Medium — EDRs can monitor child processes spawned by VS Code, but the primary execution happens in-memory within the Node.js context of the extension host using 'eval' or 'vm.Script', which may evade standard process-level monitoring. Network Visibility: High — The malware relies on external network connections to Solana RPC nodes for dead drop resolution and C2 IPs for payload retrieval, which can be detected via network telemetry. Detection Difficulty: Hard — The use of transitive dependencies means the initial extension appears benign. The malicious payload is heavily obfuscated, executed in-memory, and uses legitimate services (Solana) for dead drops, making static and dynamic analysis challenging.

Required Log Sources

  • Network flow logs
  • DNS query logs
  • Process execution logs (VS Code extension host)

Hunting Hypotheses

HypothesisTelemetryATT&CK StageFP Risk
Look for VS Code extension host processes making unexpected outbound network connections to known Solana RPC nodes or unrecognized IP addresses.Network flow logs, DNS logsCommand and ControlMedium
Monitor for sudden additions of 'extensionPack' or 'extensionDependencies' in VS Code extension manifest files (package.json) during updates.File System/ManifestsDeliveryLow
Detect HTTP responses to the VS Code extension host containing suspicious headers like 'ivbase64' and 'secretkey'.Network/HTTP logsCommand and Control/Payload DeliveryLow

Control Gaps

  • Static analysis of initial extension releases
  • Standard EDR visibility into Node.js 'vm.Script' execution

Key Behavioral Indicators

  • Late-version manifest changes adding dependencies
  • Russian locale/timezone gating in extension code
  • HTTP response headers containing decryption material (ivbase64, secretkey)

False Positive Assessment

  • Medium. Legitimate extensions frequently use 'extensionPack' and 'extensionDependencies' for convenience (e.g., language support bundles). Alerting solely on these fields will generate false positives; detection must correlate these fields with suspicious network activity or obfuscated code.

Recommendations

Immediate Mitigation

  • Audit extension histories for newly added 'extensionPack' and 'extensionDependencies' relationships.
  • Block or remove any GlassWorm-linked packages and infrastructure indicators from developer environments.

Infrastructure Hardening

  • Block outbound traffic to known malicious C2 IPs (45.32.150.251, 45.32.151.157, 70.34.242.255).
  • Implement network filtering for unexpected Solana RPC node queries from developer workstations.

User Protection

  • Review developer workstations for exposed tokens, credentials, config files, and environment secrets.
  • Deploy tools that enforce install-time visibility and policy enforcement for VS Code extensions.

Security Awareness

  • Educate developers on the risks of transitive dependencies in VS Code extensions.
  • Warn developers about extensions impersonating popular tools or inflating download counts.

MITRE ATT&CK Mapping

  • T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools
  • T1204 - User Execution
  • T1480 - Execution Guardrails
  • T1059.007 - Command and Scripting Interpreter: JavaScript
  • T1027.013 - Obfuscated Files or Information: Encrypted/Encoded File
  • T1102.001 - Web Service: Dead Drop Resolver

Additional IOCs

  • Ips:
    • 45[.]32[.]150[.]251 - Reused C2 IP
    • 45[.]32[.]151[.]157 - New C2 IP
    • 70[.]34[.]242[.]255 - New C2 IP
  • File Paths:
    • extension/out/extension.js - Staged loader location
  • Other:
    • BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC - Previous Solana wallet address used as a dead drop
    • MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr - Solana memo program used by the malware
    • c4b9a3773e9dced6015a670855fd32b - Embedded AES IV (hex)
    • aadarkcode.one-dark-material - Malicious Open VSX Extension
    • aligntool.extension-align-professional-tool - Malicious Open VSX Extension
    • angular-studio.ng-angular-extension - Malicious Open VSX Extension
    • awesome-codebase.codebase-dart-pro - Malicious Open VSX Extension
    • awesomeco.wonder-for-vscode-icons - Malicious Open VSX Extension
    • bhbpbarn.vsce-python-indent-extension - Malicious Open VSX Extension
    • blockstoks.easily-gitignore-manage - Malicious Open VSX Extension
    • brategmaqendaalar-studio.pro-prettyxml-formatter - Malicious Open VSX Extension
    • codbroks.compile-runnner-extension - Malicious Open VSX Extension
    • codevunmis.csv-sql-tsv-rainbow - Malicious Open VSX Extension
    • codwayexten.code-way-extension - Malicious Open VSX Extension
    • cosmic-themes.sql-formatter - Malicious Open VSX Extension
    • craz2team.vscode-todo-extension - Malicious Open VSX Extension
    • crotoapp.vscode-xml-extension - Malicious Open VSX Extension
    • cudra-production.vsce-prettier-pro - Malicious Open VSX Extension
    • daeumer-web.es-linter-for-vs-code - Malicious Open VSX Extension (Typosquat of dbaeumer)
    • dark-code-studio.flutter-extension - Malicious Open VSX Extension
    • densy-little-studio.wonder-for-vscode-icons - Malicious Open VSX Extension
    • dep-labs-studio.dep-proffesinal-extension - Malicious Open VSX Extension
    • dev-studio-sense.php-comp-tools-vscode - Malicious Open VSX Extension
    • devmidu-studio.svg-better-extension - Malicious Open VSX Extension
    • dopbop-studio.vscode-tailwindcss-extension-toolkit - Malicious Open VSX Extension
    • errlenscre.error-lens-finder-ex - Malicious Open VSX Extension
    • exss-studio.yaml-professional-extension - Malicious Open VSX Extension
    • federicanc.dotenv-syntax-highlighting - Malicious Open VSX Extension
    • flutxvs.vscode-kuberntes-extension - Malicious Open VSX Extension
    • gvotcha.claude-code-extension - Malicious Open VSX Extension
    • gvotcha.claude-code-extensions - Malicious Open VSX Extension
    • intellipro.extension-json-intelligence - Malicious Open VSX Extension
    • kharizma.vscode-extension-wakatime - Malicious Open VSX Extension
    • ko-zu-gun-studio.synchronization-settings-vscode - Malicious Open VSX Extension
    • kwitch-studio.auto-run-command-extension - Malicious Open VSX Extension
    • lavender-studio.theme-lavender-dreams - Malicious Open VSX Extension
    • littensy-studio.magical-icons - Malicious Open VSX Extension
    • lyu-wen-studio-web-han.better-formatter-vscode - Malicious Open VSX Extension
    • markvalid.vscode-mdvalidator-extension - Malicious Open VSX Extension
    • mecreation-studio.pyrefly-pro-extension - Malicious Open VSX Extension
    • mswincx.antigravity-cockpit - Malicious Open VSX Extension
    • mswincx.antigravity-cockpit-extension - Malicious Open VSX Extension
    • namopins.prettier-pro-vscode-extension - Malicious Open VSX Extension
    • oigotm.my-command-palette-extension - Malicious Open VSX Extension
    • otoboss.autoimport-extension - Malicious Open VSX Extension
    • ovixcode.vscode-better-comments - Malicious Open VSX Extension
    • pessa07tm.my-js-ts-auto-commands - Malicious Open VSX Extension
    • potstok.dotnet-runtime-extension - Malicious Open VSX Extension
    • pretty-studio-advisor.prettyxml-formatter - Malicious Open VSX Extension
    • prismapp.prisma-vs-code-extension - Malicious Open VSX Extension
    • projmanager.your-project-manager-extension - Malicious Open VSX Extension
    • pubruncode.ccoderunner - Malicious Open VSX Extension
    • pyflowpyr.py-flowpyright-extension - Malicious Open VSX Extension
    • pyscopexte.pyscope-extension - Malicious Open VSX Extension
    • redcapcollective.vscode-quarkus-elite-suite - Malicious Open VSX Extension
    • rubyideext.ruby-ide-extension - Malicious Open VSX Extension
    • runnerpost.runner-your-code - Malicious Open VSX Extension
    • shinypy.shiny-extension-for-vscode - Malicious Open VSX Extension
    • sol-studio.solidity-extension - Malicious Open VSX Extension
    • ssgwysc.volar-vscode - Malicious Open VSX Extension
    • studio-jjalaire-team.professional-quarto-extension - Malicious Open VSX Extension
    • studio-velte-distributor.pro-svelte-extension - Malicious Open VSX Extension
    • sun-shine-studio.shiny-extension-for-vscode - Malicious Open VSX Extension
    • sxatvo.jinja-extension - Malicious Open VSX Extension
    • tamokill12.foundry-pdf-extension - Malicious Open VSX Extension
    • thing-mn.your-flow-extension-for-icons - Malicious Open VSX Extension
    • tima-web-wang.shell-check-utils - Malicious Open VSX Extension
    • tokcodes.import-cost-extension - Malicious Open VSX Extension
    • toowespace.worksets-extension - Malicious Open VSX Extension
    • treedotree.tree-do-todoextension - Malicious Open VSX Extension
    • tucyzirille-studio.angular-pro-tools-extension - Malicious Open VSX Extension
    • turbobase.sql-turbo-tool - Malicious Open VSX Extension
    • twilkbilk.color-highlight-css - Malicious Open VSX Extension
    • vce-brendan-studio-eich.js-debuger-vscode - Malicious Open VSX Extension
    • yamaprolas.revature-labs-extension - Malicious Open VSX Extension

Related