GlassWorm Infiltrated VSX Extensions with More than 22,000 Downloads to Attack Developers

GlassWorm is a supply-chain malware campaign that compromised the oorzc publisher on the Open VSX Registry to push malicious updates to four legitimate extensions (together with over 22,000 downloads). The staged macOS-focused loader profiles victims, avoids Russian locales, retrieves commands via Solana transaction memos, persists using a LaunchAgent, and steals browser data, cryptocurrency wallets, SSH keys and cloud/GitHub/npm credentials before exfiltration; Open VSX later removed the malicious releases and revoked the publisher's tokens.