GlassWorm malware attacks return via 73 OpenVSX "sleeper" extensions

GlassWorm operators pushed 73 'sleeper' extensions to the OpenVSX marketplace that appear benign on upload but later activate to fetch and install malicious payloads via secondary VSIX packages, platform-specific .node modules, or obfuscated JavaScript; researchers at Socket found six active malicious extensions and classify the remainder as dormant or suspicious, advising developers to rotate secrets and clean affected environments.