More supply chain havoc from the GlassWorm threat has made its way into the software development mix, poisoning software components that have thousands of downstream users.
Researchers with application development security vendor Socket last week detailed a supply chain attack involving Trojanized versions of four legitimate components distributed via the Open VSX registry.
Socket reported the attack to Open VSX and the Eclipse Foundation on Jan. 30, and the malicious versions of each component were quickly removed. It's difficult to say how many victims may have slipped through the cracks even despite quick action on the part of all parties involved. But Socket's blog points out that FTP/SFTP/SSH Sync Tool, I18n Tools, vscode mindmap, and scss to css "collectively accumulated over 22,000 Open VSX downloads prior to the malicious releases."
Concerning a likely origin for the threat, "the Open VSX security team assessed the activity as consistent with a leaked token or other unauthorized access," Socket's Kirill Boychenko wrote.
Related:Chinese Hackers Hijack Notepad++ Updates for 6 Months
The end goal, as is often the case with app-dev supply chain attacks, was to infect downstream users with information stealers. The approach is becoming a trend: Some particularly scary versions of this type of attack occurred last year with the self-replicating Shai-hulud worm. And a slew of supply chain attacks involving software components last summer led GitHub to commit to a more secure NPM ecosystem.
GlassWorm Continues Inching Forward
GlassWorm malware was first discovered by Koi Security in the fall of 2025. The vendor observed the malware's self-propagating nature (not unlike Shai-hulud) and saw it infect tens of thousands of developer machines.
A developer would download a poisoned component, the malware would steal credentials, and then the actor would abuse publishing access to put up poisoned versions, spreading the malware further. It was also stealthy and coded with invisible Unicode characters — the invisible character trick seen in earlier versions has been replaced with encrypted, staged loaders in recent iterations.
Once it got into a machine, GlassWorm stole credentials like NPM, GitHub, and Git, as well as cryptocurrency wallets. It leveraged the Solana blockchain for command and control (C2) as well as Google Calendar for backup command. Attacks continued well beyond that initial wave, despite the Eclipse Foundation calling the situation contained at the time.
... continue reading