GlassWorm: self-propagating worm in OpenVSX and VS Code extensions hides payload in invisible Unicode (no CVE)
Severity: high · Patch status: no-fix-needed · Since 2025-10-20
Koi Security reported on 2025-10-17 that seven OpenVSX extensions had been compromised, then more on OpenVSX and one on Microsoft's VS Code Marketplace (cline-ai-main.cline-ai-agent 3.1.3, removed by Microsoft after being alerted). The injected JavaScript was encoded in invisible Unicode characters so it does not render in editors. On a developer machine it steals npm, GitHub and Git/OpenVSX credentials and uses them to push malicious updates to further extensions the victim can publish, targets data from 49 crypto-wallet extensions, and installs a SOCKS proxy and hidden VNC for remote access. Command and control uses a Solana wallet and transaction, a Google Calendar event as backup and a hard-coded IP. Because editors auto-update extensions, infected builds installed without user action; Koi counted about 35,800 installs. Two publishers cleaned their extensions on 2025-10-18, but ten extensions were still distributing the malware two days after the first report. This was the original GlassWorm campaign; the Oct 2026 OVHcloud CLI release swap used the same malware family.
What to do
- Inventory installed VS Code/Cursor/VSCodium extensions and compare against the named list (e.g. codejoy.codejoy-vscode-extension 1.8.3/1.8.4, l-igh-t.vscode-theme-seti-folder 1.2.3, cline-ai-main.cline-ai-agent 3.1.3); remove any match.
- On Windows hosts, check HKCU and HKLM Software\Microsoft\Windows\CurrentVersion\Run for unknown entries, and look for connections to 217.69.3.218 and 140.82.52.31.
- If a listed version was ever installed, rotate npm tokens, GitHub tokens, Git credentials and OpenVSX tokens present on that machine, and review package/extension publishes made with them.
- Disable extension auto-update on developer machines or use an allowlist of approved extensions.
Sources
All live incidents on Threat Watch
