GlassWorm Campaign Expands Through Malicious Open VSX Extensions

GlassWorm has expanded its operations by abusing Open VSX extension manifest fields (extensionPack and extensionDependencies) to deliver malware transitively through seemingly benign developer extensions; researchers identified at least 72 additional malicious extensions, live examples still active, and associated infrastructure (Solana wallets, C2 IPs, cryptographic artifacts) while noting changes in obfuscation and delivery techniques.