73 Suspicious VS Code Extensions Tied to GlassWorm

Cybersecurity researchers have uncovered 73 suspicious Visual Studio Code extensions published to the OpenVSX registry in early April 2026, linking them to the ongoing GlassWorm malware campaign that targets developers' credentials and cryptocurrency wallets. At least six of these extensions have activated to deliver malicious payloads, while the rest appear dormant but follow patterns suggesting future weaponization.

The extensions impersonate legitimate ones by closely mimicking names, icons, descriptions, and even README content. Subtle differences, such as publisher names and unique identifiers, distinguish them, but developers often overlook these during installation. Initially published without detectable malware, the packages build install bases through normal updates before introducing harmful code. "Cloned or impersonating extensions are first published without an obvious payload, then later updated to deliver malware," Socket researchers noted.

Malware delivery varies across the cluster. Some extensions fetch secondary VSIX packages from GitHub repositories using command-line tools, installing them into multiple integrated development environments like VS Code, Cursor,...