An Evolving GlassWorm Malware is Making the Rounds of Code Repositories

GlassWorm, a persistent supply-chain malware actor, has resurged with an evolved multi-stage framework that distributes malicious packages and extensions across npm, PyPI, Open VSX, GitHub and Visual Studio Marketplace to harvest credentials, exfiltrate cloud secrets and crypto, and install a RAT with HVNC capabilities; it uses invisible Unicode loaders, Solana memo-based C2, transitive extension dependencies for stealthy delivery, and has begun compromising MCP servers used by AI tooling.