Dozens of OpenVSX Extension Clone Attacks Tied to GlassWorm Malware

Post Views: 6

Over 70 Extensions on Open VSX Marketplace Likely Linked to GlassWorm Malware

In recent months, a series of malicious extensions have emerged on the Open VSX marketplace, compromising numerous repositories and stealing sensitive information.

According to cybersecurity researchers, more than 70 extensions published to the platform in April are suspected to be clones of legitimate extensions, designed to deploy malware on users’ machines through future updates.
These extensions, created by newly established GitHub accounts with generic names, exhibit a clear impersonation pattern, mirroring the legitimate extensions in terms of iconography, naming conventions, and descriptions.
However, upon closer inspection, the malicious extensions feature distinct identifiers and publishers, suggesting a deliberate attempt to deceive users.
The malware delivery mechanism employed by these extensions involves a combination of previously observed tactics, including bundling native binaries and retrieving payloads from remote locations.
This approach allows the threat actors to evade detection by hiding critical logic outside of traditional scanning tools and spreading it across multiple delivery channels.

Law Enforcement Actions and Financial Losses

Researcher noted that “the compromise of numerous repositories and the potential theft of sensitive information underscore the severity of this threat.”

Specific figures regarding financial losses are not available, but law enforcement agencies have taken notice of the situation, and ongoing investigations aim to disrupt the activities of the threat actors responsible for the GlassWorm malware.

Timeline of Events

October 2025: Initial appearance of GlassWorm malware in the Open VSX registry.
November 2025: Spread of GlassWorm to other open-source software ecosystems.
January 2026: Re-emergence of GlassWorm, compromising over 150 repositories.
March 2026: Further compromise of additional repositories, leading to the discovery of the malicious extensions.
April 2026: Over 70 extensions suspected to be linked to GlassWorm malware are discovered on the Open VSX marketplace.