GlassWorm Abuses VS Code Extensions to Fuel Supply Chain Attacks

GlassWorm is conducting a supply-chain campaign in the Open VSX extension marketplace by abusing Extension Packs and Dependencies to convert benign-looking extensions into delivery vehicles for an obfuscated RCE backdoor. The campaign uses staged loaders, Russian locale/time geofencing to avoid analysis, and Solana transaction memos as covert C2 ‘dead drops’; identified malicious packages include otoboss.autoimport-extension, federicanc.dotenv-syntax-highlighting, and aadarkcode.one-dark-material. Recommended actions include immediate removal of identified extensions, full compromise analysis, auditing extension dependencies, and monitoring the extension host for heavy obfuscation or runtime eval activity.