GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers

Researchers have identified a significant escalation in the GlassWorm campaign: attackers are abusing Open VSX extension relationships (extensionPack/extensionDependencies) and invisible Unicode obfuscation to turn benign-looking VS Code extensions and upstream packages into transitive delivery vehicles for a credential/secret- and crypto-wallet-stealing loader that uses Solana transactions for resilient C2 resolution; the activity spans dozens of malicious Open VSX extensions, many GitHub repositories, and multiple npm packages, and employs Remote Dynamic Dependencies to retain remote control of payloads.