GlassWorm Malware Expands to Developer Tools

Security researchers have uncovered an expanded malware campaign known as GlassWorm, which now exploits developer tools across multiple platforms to steal credentials and spread infections. The operation, active since late 2025, has targeted at least 72 malicious extensions in the Open VSX registry since January 31, 2026, and extended to hundreds of Python repositories on GitHub starting March 8, 2026, by leveraging stolen access tokens.

In the Open VSX attacks, which serve as an open-source alternative to Microsoft's Visual Studio Marketplace, threat actors publish extensions that initially appear legitimate. These impersonate popular developer utilities, such as linters like ESLint, formatters like Prettier, code runners, and tools for languages including Python, Angular, Flutter, and Vue. Some also mimic AI coding assistants related to Claude Code, Codex, and Antigravity. To enhance credibility, the extensions display inflated download counts, sometimes in the thousands.

The core evasion tactic involves the extension manifest fields extensionPack and extensionDependencies, which allow one extension to automatically install others upon user setup. Researchers at Socket, a...