GlassWorm Spreads via 72 Malicious Open VSX Extensions Hidden in Transitive Dependencies

The report describes the GlassWorm campaign which increasingly targets developers by publishing clean Open VSX extensions that later pull malicious extensions via extensionPack/extensionDependencies, enabling stealthy transitive delivery of loaders that steal credentials, tokens, and environment secrets. Researchers identified at least 72 malicious Open VSX extensions, noted infrastructure updates (Solana wallet rotation, C2 IPs), stronger obfuscation, and use of externalized decryption keys; the report recommends auditing extension histories, monitoring install chains and known IoCs, and securing developer endpoints.