Comprehensive Threat Exposure Management Platform
A sophisticated supply-chain attack struck the Open VSX Registry after threat actors compromised the legitimate developer account “oorzc” and used it to distribute malicious updates embedding the GlassWorm malware loader across four trusted VS Code extensions with more than 22,000 combined downloads. Once installed, the malware targets macOS systems, stealing credentials, cryptocurrency wallet information, and sensitive developer data. The attack was first detected on January 30, 2026, and affects users worldwide with the exception of Russia. The four compromised extensions are FTP/SFTP/SSH Sync Tool, I18n Tools, vscode mindmap, and scss to css. GlassWorm employs advanced evasion techniques including AES-256-CBC encryption, EtherHiding via Solana blockchain transaction memos for command-and-control resolution, and Russian locale avoidance, indicating likely Russian-speaking threat actor attribution.
A trusted software supply channel was quietly turned into a malware delivery mechanism on January 30, 2026, after attackers compromised the publishing credentials of a legitimate Open VSX developer known as “oorzc.” Leveraging this access, they released poisoned updates for four popular extensions—FTP/SFTP/SSH Sync Tool, I18n Tools, vscode mindmap, and scss to css. Since these extensions had been widely used for more than two years and accumulated over 22,000 downloads, the malicious updates spread through an already trusted ecosystem, bypassing common detection triggers such as typosquatting or fake developer accounts.
The malicious updates embedded nearly identical loaders inside extension code, where an AES-256-CBC encrypted payload was decrypted at runtime and executed through eval(). The loader also profiled system environments and deliberately avoided running on systems configured with Russian-language locales, a tactic often associated with campaigns tied to Russian-speaking threat actors. To further evade detection, the attackers employed EtherHiding techniques, using Solana blockchain transaction memos to dynamically resolve command-and-control infrastructure without needing to update the compromised extensions again.
Once executed, the GlassWorm malware established persistence on macOS systems using a LaunchAgent mechanism, ensuring automatic execution at login. It then began collecting sensitive information, including browser credentials, cookies, browsing history, cryptocurrency wallet data from both browser extensions and desktop wallet applications, iCloud Keychain contents, Apple Notes databases, Safari cookies, and files stored in common user directories. VPN configuration data was also targeted, expanding the scope of potential access.
The harvested data was transmitted to attacker-controlled infrastructure while communications relied on a resilient, multi-layered command-and-control structure combining direct IP connections, blockchain-based dead drops, and backup communication channels through Google Calendar events. Of particular concern is the theft of developer and cloud credentials, such as npm tokens, GitHub authentication artifacts, and SSH or AWS keys, which could enable attackers to infiltrate enterprise environments, move laterally across networks, and potentially compromise additional software packages in a cascading supply-chain attack.
Immediately scan all development environments to identify and remove any installed extensions from the compromised author “oorzc” and verify extension integrity across all developer workstations.
Review network logs for indicators of the GlassWorm loader including connections, and verify that no unauthorized data exfiltration has occurred from development systems.
Any systems that had the compromised extensions installed should undergo full credential rotation including npm tokens, GitHub credentials, SSH keys, AWS credentials, and any stored authentication material.
Enforce multi-factor authentication for all developer accounts on Open VSX, VS Code Marketplace, npm, GitHub, and other publishing platforms to prevent credential-based account takeovers.
Evaluate and restrict access to extension marketplaces where possible, implementing allow-lists for approved extensions and limiting auto-update functionality on developer machines.
On macOS systems, regularly audit LaunchAgent configurations for unauthorized persistence mechanisms that may indicate GlassWorm or similar malware infections.
Initial Access
Execution
Persistence
Defense Evasion
Credential Access
Collection
Command and Control
Exfiltration
Discovery
Compromised Open VSX Extensions:
Additional Malicious Extensions (17 total):
Solana Address: BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC
AES Encryption Details:
Command-and-Control IP: 45.32.150.251
Get through updates and upcoming events, and more directly in your inbox