Security researchers have identified a self‑propagating worm that infects Visual Studio Code extensions published on the Open VSX Registry and the Microsoft Extension Marketplace and harvests developer credentials and cryptocurrency data. The campaign was named GlassWorm by Koi Security, which described the infection chain and capabilities in a technical report.
Unlike many malware campaigns that rely on central servers, the threat uses the Solana blockchain as a resilient command‑and‑control channel and falls back to Google Calendar events for additional instructions. The malicious extensions also employ special invisible Unicode characters to hide code in editors; the report points to the use of Unicode variation selectors to mask the payload and its actions, a technique highlighted by Idan Dardikman in the Koi Security write‑up.
According to the analysis, the injected code scans Solana transactions for activity tied to an attacker‑controlled wallet and extracts a Base64‑encoded string from the transaction memo field that decodes to the address of a recovery server. The subsequent payload steals npm, Open VSX, GitHub and Git credentials, targets 49 cryptocurrency wallet extensions for fund theft, deploys SOCKS proxies and hidden VNC servers, and exfiltrates data to a remote endpoint identified in the report.
Koi Security said the post‑infection module, dubbed Zombi and written in JavaScript, extends the compromise by dropping a SOCKS proxy, WebRTC components for peer communication, BitTorrent DHT for decentralized command distribution and HVNC for remote access. The researchers noted the campaign is aided by VS Code’s auto‑update behavior, which can allow malicious updates to be pushed without user interaction.
Investigators identified 14 infected extensions – 13 on Open VSX and one on the Microsoft Extension Marketplace — that had been downloaded about 35,800 times; the first wave of infections was observed on October 17, 2025. The report states it is not yet known how the extensions were initially compromised. The Koi Security analysis characterises GlassWorm as a self‑spreading supply‑chain worm designed to propagate through the developer ecosystem.
The research comes amid wider attention to the use of blockchains and other decentralised channels for staging malicious payloads.