glassworm malware is back in circulation after security researchers discovered three new malicious VSCode extensions on the OpenVSX marketplace. These uploads revived the same threat operators that earlier distributed harmful extensions before their takedown. The new campaign uses updated techniques, stronger persistence, and stealthier exfiltration methods, raising concerns about the safety of open development ecosystems.
Attackers resurface with three new extensions
Researchers found the malicious extensions under the names “aspnet helper,” “csharp theme,” and “black formatter.” All three were uploaded by the account “devgossy.” The extensions appeared legitimate at first glance, but they carried hidden scripts that executed immediately after installation.
Each extension attempted to steal data from the developer’s machine, including environment details, workspace information, configuration files, and authentication material. Some versions reached out to remote servers for additional commands. These behaviours match earlier GlassWorm activity that you reported during the previous discovery cycle.
How the extensions operated
The malicious extensions shipped with obfuscated JavaScript. Once installed, they launched background tasks that downloaded secondary payloads. These payloads attempted to map directories, read sensitive files, and gather metadata about active projects.
The extensions also created persistence by planting scripts within the user’s VSCode environment. That tactic allowed the malware to relaunch even after removal attempts. The attackers relied on trusted extension events like activation hooks and post-install triggers, blending their actions into normal development workflows.
Why this threat persists
Open-source extension marketplaces remain a prime target for attackers. Developers install tools rapidly, often without reviewing code. Threat actors exploit this pattern by releasing extensions that appear useful, updated, or aligned with popular technologies.
glassworm malware uses this advantage effectively. The previous campaign showed how easily attackers insert malicious uploads into community repositories. This new wave demonstrates that takedowns alone do not eliminate the threat when adversaries continue to create fresh accounts and publish updated packages.
Impact on the developer ecosystem
These malicious extensions pose serious risks for individual developers and large organisations. Attackers can harvest project secrets, scoped tokens, dependency information, and internal architecture files. That data enables follow-up attacks, supply-chain compromises, and credential-phishing operations.
The threat hits hardest in teams that rely on automated build pipelines. Stolen configuration files or exposed environment variables can create opportunities for deeper infiltration across interconnected services.
Marketplace response
OpenVSX maintainers removed the three extensions shortly after the report. They urged developers to audit installed extensions and review logs for suspicious activity. Teams that may have used the extensions should rotate credentials, inspect recent project changes, and verify that no unauthorized scripts remain inside their VSCode profiles.
Conclusion
glassworm malware has re-emerged with new VSCode extensions that imitate legitimate tools while stealing sensitive data and creating persistence within developer workspaces. This attack highlights ongoing vulnerabilities in extension marketplaces and shows how easily malicious actors exploit trust within open-source environments. Developers and organisations must apply stricter extension-review processes, enforce dependency policies, and maintain continuous monitoring to defend against future waves of this threat.
0 responses to “Glassworm malware returns through new malicious VSCode extensions”