Glassworm malware returns in third wave of malicious VS Code packages

The Glassworm campaign, which first emerged on the OpenVSX and Microsoft Visual Studio marketplaces in October, is now in its third wave, with 24 new packages added on the two platforms.

OpenVSX and the Microsoft Visual Studio Marketplace are both extension repositories for VS Code–compatible editors, used by developers to install language support, frameworks, tooling, themes, and other productivity add-ons.

The Microsoft marketplace is the official platform for Visual Studio Code, while OpenVSX is an open, vendor-neutral alternative used by editors who can’t or don’t use Microsoft’s proprietary store.

First documented by Koi Security on October 20, Glassworm is a malware that uses “invisible Unicode characters” to hide its code from review.

Once developers install it in their environments, it attempts to steal GitHub, npm, and OpenVSX accounts, as well as cryptocurrency wallet data from 49 extensions.

Moreover, the malware deploys a SOCKS proxy to route malicious traffic through the victim’s machine and installs the HVNC client to give operators stealthy remote access.

Although the initial infection was cleaned from the extension repositories, the malware returned to both sites shortly after with new extensions and publisher accounts.

Prior to this, Open VSX had declared the incident fully contained, with the platform rotating compromised access tokens.

The re-emergence of Glassworm was discovered by Secure Annex’s researcher, John Tuckner, who reports that the package names indicate a broad targeting scope covering popular tools and developer frameworks like Flutter, Vim, Yaml, Tailwind, Svelte, React Native, and Vue.

Secure Annex has now found that the third wave uses the packages listed below.

VS Marketplace

1. iconkieftwo.icon-theme-materiall
2. prisma-inc.prisma-studio-assistance
3. prettier-vsc.vsce-prettier
4. flutcode.flutter-extension
5. csvmech.csvrainbow
6. codevsce.codelddb-vscode
7. saoudrizvsce.claude-devsce
8. clangdcode.clangd-vsce
9. cweijamysq.sync-settings-vscode
10. bphpburnsus.iconesvscode
11. klustfix.kluster-code-verify
12. vims-vsce.vscode-vim
13. yamlcode.yaml-vscode-extension
14. solblanco.svetle-vsce
15. vsceue.volar-vscode
16. redmat.vscode-quarkus-pro
17. msjsdreact.react-native-vsce

Open VSX

1. bphpburn.icons-vscode
2. tailwind-nuxt.tailwindcss-for-react
3. flutcode.flutter-extension
4. yamlcode.yaml-vscode-extension
5. saoudrizvsce.claude-dev
6. saoudrizvsce.claude-devsce
7. vitalik.solidity

Once the packages are accepted on the marketplaces, the publishers push an update that introduces the malicious code, then inflate their download counts to make them appear legitimate and trustworthy.

Also, artificially increasing download counts can manipulate search results, with the malicious extension appearing higher in the results, often very close to the legitimate projects it impersonates.

The researcher reports that Glassworm has evolved on the technical side as well, now using Rust-based implants packaged inside the extensions. The invisible Unicode trick is also still used in some cases.

BleepingComputer has contacted both OpenVSX and Microsoft regarding Glassworm’s continued ability to bypass their defenses, and we will update this post with their responses once received.