GlassWorm Malware Returns to Shatter Developer Ecosystems

Researchers reported a GlassWorm supply-chain campaign in which four legitimate Open VSX components were Trojanized (likely via a leaked token or account compromise) and collectively amassed over 22,000 downloads; the payloads acted as infostealers harvesting developer credentials, browser and wallet data, and other sensitive files, leveraging blockchain-based C2 and staged loaders, and the report includes IOCs and mitigation steps such as credential rotation and artifact removal.