Fresh Wave of GlassWorm VS Code Extensions Slices Through Supply Chain

Researchers from Socket describe a renewed GlassWorm campaign that has published a cluster of ~73 'sleeper' VS Code/Open VSX extensions which initially appear benign but can later fetch or execute malicious payloads (including bundled native installers) to deploy self‑propagating infostealers that steal developer secrets and poison the software supply chain. Attackers clone legitimate listings to trick developers, at least six extensions have already activated malicious payloads, IoCs are provided, and the report urges continuous monitoring, publisher verification, and audit of extension updates to mitigate risk.