The Sleeper in Your IDE: Unmasking the 73-Extension “GlassWorm” Espionage Campaign

Researchers at Socket are tracking the GlassWorm campaign: a sophisticated cyber-espionage operation that publishes 'sleeper' impersonation extensions to IDE marketplaces (Open VSX, VS Code, Cursor, Windsurf). The campaign comprises 73 cloned extensions (at least six weaponized), leverages native .node binaries and heavy JavaScript obfuscation to retrieve payloads from GitHub releases, and uses recurring repository naming patterns to hide malicious updates and evade static detection—turning trusted developer tools into malware delivery mechanisms.