73 Open VSX Sleeper Extensions Linked to GlassWorm Activate New Malware Campaign

GlassWorm operators published 73 ‘sleeper’ extensions to the Open VSX marketplace (identified April 2026) that initially appear benign and later receive updates to install malicious .vsix payloads; delivery methods include hidden native binaries and heavily obfuscated JavaScript that fetches payloads from GitHub. The campaign has activated at least six extensions and includes observable indicators (SHA256 hashes, a malicious GitHub repo, and confirmed extension names) that defenders should monitor and use to validate publisher namespaces and download counts before installation.