- The GlassWorm supply chain Malware campaign resurfaced in December 2025, targeting extensions in Microsoft Visual Studio Marketplace and Open VSX.
- The campaign involves 24 malicious extensions impersonating popular developer tools like Flutter, React, and Tailwind.
- Attackers use stolen credentials to spread malware by compromising legitimate packages and inflating download counts to appear trustworthy.
- Malicious extensions include Rust-based implants that fetch command-and-control data from the Solana Blockchain and Google Calendar events.
- This campaign converts developer machines into nodes for wider malicious activities and drains cryptocurrency wallets.
In December 2025, the GlassWorm supply chain malware campaign emerged again, affecting both the Microsoft Visual Studio Marketplace and Open VSX platforms. This episode involved 24 extensions posing as widely-used developer tools and frameworks, including Flutter, React, Tailwind, Vim, and Vue.
Originally detected in October 2025, GlassWorm uses the Solana blockchain for its command-and-control (C2) operations. The malware harvests credentials from npm, Open VSX, GitHub, and Git to steal cryptocurrency assets and convert infected developer machines into attacker-controlled nodes. The stolen credentials also facilitate compromising additional packages, allowing the malware to spread like a worm. Efforts to remove the threat by Microsoft and Open VSX have been challenged by the malware’s persistence, with attacks recently targeting GitHub repositories as well.
Cybersecurity expert John Tuckner of Secure Annex identified 24 malicious extensions in the latest wave, divided between the two marketplaces. Notable compromised extensions include iconkieftwo.icon-theme-materiall, flutcode.flutter-extension, and msjsdreact.react-native-vsce on VS Code Marketplace, alongside tailwind-nuxt.tailwindcss-for-react and vitalik.solidity on Open VSX. One of the extensions, prisma-inc.prisma-studio-assistance, was removed by Microsoft on December 1, 2025.
Attackers artificially inflate download counts to make these extensions appear legitimate and increase their visibility near authentic projects. According to Tuckner, “Once the extension has been approved initially, the attacker seems to easily be able to update code with a new malicious version and easily evade filters.” The malicious code activates soon after the legitimate extension launches.
This iteration of GlassWorm includes Rust-based implants embedded in the extensions. An analysis of the “icon-theme-materiall” extension by Nextron Systems showed two implants targeting Windows and macOS: a Windows DLL named os.node and a macOS dynamic library darwin.node. These implants retrieve C2 server details from the Solana blockchain wallet address or parse Google Calendar events as a fallback, then download encrypted JavaScript payloads to execute further commands.
Tuckner emphasized the scale of this attack, noting “Rarely does an attacker publish 20+ malicious extensions across both of the most popular marketplaces in a week.” This poses significant risk as many developers could be compromised with just one click.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- BNP Paribas Joins Euro Stablecoin Consortium Qivalis Launching 2025
- Mistral AI Debuts Mistral 3, Turbocharges Nvidia Blackwell Performance
- UK to Ban Political Parties from Accepting Crypto Donations
- CME Group Launches New Crypto Benchmarks for Institutional Traders
- Nvidia CFO: Global GPU Data Centers May Hit $4 Trillion by 2030
