GlassWorm Self-Propagating Malware Compromises VS Code Extensions

Threat Group – Unknown (no confirmed attribution)
Threat Type – Self-propagating software supply chain malware targeting VS Code and OpenVSX ecosystems
Exploited Vulnerabilities – Abuse of trusted publisher credentials and the automated extension update pipeline; no CVE assigned for the platform itself
Malware Used – GlassWorm loader and final-stage ZOMBI module (RAT with SOCKS proxy, HVNC, P2P C2, credential theft, and self-replication)
Threat Score – 🔴 8.1 High
Last Threat Observation – 22 October 2025

Overview

The GlassWorm campaign represents a significant escalation in developer tool supply-chain threats. Rather than exploiting a zero-day vulnerability, the operators weaponise trust—they obtain or hijack legitimate publisher credentials, insert a self-replicating loader into existing extensions, and rely on default auto-updates to deliver the malware silently to developer workstations.

Stealth is achieved through invisible Unicode variation selectors (U+FE0E / U+FE0F) embedded within JavaScript and TypeScript files. These characters cause the malicious code to render as blank space in editors and code diff tools, evading manual inspection and many static scanners—yet remain fully executable.

Once executed, the loader fetches and decrypts the ZOMBI module, a heavily obfuscated remote-access payload that transforms infected developer workstations and CI/CD runners into autonomous nodes within the attacker’s infrastructure. The ZOMBI module establishes persistence (Windows Registry Run keys), deploys SOCKS proxy services, installs Hidden VNC (HVNC) for covert remote control, and abuses harvested NPM, GitHub, OpenVSX, and Git credentials to publish new malicious extensions, ensuring rapid, self-sustaining propagation.

Resilience is achieved through a triple-redundant, decentralised command-and-control (C2) structure using the Solana blockchain (primary), direct IP/HTTP fallback, and Google Calendar event titles (cloud-based fallback). Additionally, WebRTC and BitTorrent Distributed Hash Table (DHT) layers provide peer-to-peer redundancy, making the infrastructure effectively untakeable down by traditional means.

Given the malware’s stealth, propagation potential, and decentralised resilience, the threat score of 8.1 (High) is fully validated.

Key Details

Delivery Method

• The attackers compromise legitimate extension publisher accounts or insert malicious code during the release process.
• Modified extensions are published to OpenVSX and VS Code Marketplace with invisible Unicode-encoded loaders.
• Auto-update mechanisms silently deliver the malicious versions to users without any prompts.
• The malicious code retrieves and decrypts the ZOMBI payload, which establishes persistence and further propagation.
• Using stolen tokens, the malware publishes new infected extension updates, ensuring exponential spread.

Target Profile

• Software developers using VS Code and compatible IDEs.
• Extension publishers and CI/CD systems holding tokens for OpenVSX, Marketplace, NPM, and GitHub.
• Organisations with integrated development pipelines linked to repositories.
• Cryptocurrency-related extensions (secondary objective: financial theft).

Functions (ZOMBI Module)

• Credential theft: NPM, GitHub, OpenVSX, Git, and cryptocurrency wallet extensions.
• Remote control: Deploys Hidden VNC for invisible, interactive sessions.
• Network proxying: Installs a SOCKS proxy for attacker traffic routing.
• Propagation: Automatically publishes new malicious updates with stolen credentials.
• Decentralised C2: Communicates via blockchain memos, fallback HTTP, Google Calendar, WebRTC, and BitTorrent DHT.

Obfuscation and Evasion

• Invisible Unicode (U+FE0E / U+FE0F) conceals code from human and automated review.
• Dynamic decryption keys returned via HTTP headers decrypt payloads in memory.
• Decentralised infrastructure blends with legitimate traffic, making takedown impractical.
• Modular payload design allows flexible updates and rapid redeployment.

Attack Vectors

Known Indicators of Compromise (IoCs)

(All indicators are defanged to prevent accidental activation. Replace hxxp→http/https and [.]→. in a secure analysis environment.)

Network / C2 / Exfiltration

Host-Based Indicators and Persistence

Confirmed Infected Extensions

Mitigation and Prevention

Mitigation Checklist

Detection Engineering

Host-Based Detection

• Alert on extensionHost.exe or child processes spawning VNC or proxy listeners.
• Monitor registry writes to HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run by IDE processes.
• Scan %APPDATA%\Code\extensions\* for invisible Unicode sequences (U+FE0E / U+FE0F).
• Identify JavaScript files with large “blank” code regions that contain invisible characters.

Network-Based Detection

Remediation and Containment Checklist

Risk Assessment

Threat Score – 🔴 8.1 High

GlassWorm presents one of the most sophisticated supply-chain threats to date. It leverages legitimate update mechanisms, employs stealth through invisible code, and communicates via decentralised, immutable networks.
It compromises developer environments, CI/CD runners, and build pipelines, converting trusted assets into active threat nodes.

The combination of:

• Propagation via auto-updates
• Invisible code obfuscation
• Blockchain and P2P C2 infrastructure
• Credential abuse for self-replication

justifies its classification as a high-severity threat requiring immediate containment and long-term governance reforms.

Conclusion

GlassWorm redefines the concept of a supply-chain compromise by attacking the foundation of trust within the development ecosystem. It bypasses CVE-driven vulnerability management entirely, instead exploiting publisher legitimacy and automation pipelines to spread autonomously.

Traditional takedown strategies are ineffective due to its decentralised architecture (Solana, WebRTC, DHT). Therefore, defence must pivot to behavioural detection, credential governance, and extension verification workflows.

Organisations must recognise developer endpoints and build systems as critical infrastructure, applying Zero Trust segmentation, strict extension governance, and automated invisible-character scanning to protect against this new class of self-propagating supply-chain worm.

Sources

• Koi Security – GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace – https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace
• BleepingComputer – Self-Spreading GlassWorm Malware Hits OpenVSX, VS Code Registries – https://www.bleepingcomputer.com/news/security/self-spreading-glassworm-malware-hits-openvsx-vs-code-registries/
• SecurityWeek – Supply Chain Attack Targets VS Code Extensions With ‘GlassWorm’ Malware – https://www.securityweek.com/supply-chain-attack-targets-vs-code-extensions-with-glassworm-malware/