A dangerous, self-propagating malware named GlassWorm has been discovered conducting a supply-chain attack across the Visual Studio Code (VS Code) and Open-VSX marketplaces. Discovered by the security firm Koi, this malware is designed to steal developer credentials (GitHub, npm, Open VSX access), siphon cryptocurrency data, and transform compromised machines into proxy nodes. GlassWorm achieves unprecedented stealth by embedding malicious JavaScript code using invisible Unicode characters that evade static analysis tools. Furthermore, it employs the decentralized Solana Blockchain for its Command-and-Control (C2) infrastructure, making the network highly resilient against takedowns. The malware also installs a sophisticated Remote-Access-Trojan (RAT) called "Zombie," which uses P2P WebRTC and BitTorrent for command distribution, turning infected systems into SOCKS proxy servers for internal network access. As of the discovery date, the worm had infected approximately 35,800 installations.
GlassWorm: An Invisible, Blockchain-Powered Supply-Chain Attack
Alert! (Start): A supply-chain attack is running across the Microsoft and Open-VSX Visual Studio Code marketplaces, involving a self-replicating malware named GlassWorm, discovered by the endpoint security company Koi.
Malware Objectives: GlassWorm steals credentials, specifically targeting developer platforms (npm, GitHub, Git) and cryptocurrency wallets. It also utilizes the compromised machine as a proxy node after installing a Remote-Access-Trojan (RAT).
Initial Vector: The malware was first identified in the Open VSX Extension CodeJoy (starting in version 1.8.3), demonstrating suspicious network behavior unrelated to its advertised functionality. Extensions with extensions.autoUpdate enabled are automatically compromised.
Key Takeaway: Invisible Code: GlassWorm utilizes non-displayable Unicode characters (specifically from the Variant Selectors block) to render sections of its malicious code invisible to both human reviewers and static code analysis tools, yet the code is fully executable by the JavaScript interpreter. This novel stealth technique is the basis for the name "GlassWorm."
Novel C2 Infrastructure: GlassWorm uses the Solana Blockchain as its Command-and-Control (C2) infrastructure, retrieving links to its main payload in Base64 format.
Resilience: Using Solana offers the attackers a distributed, anonymous, and immutable C2 solution that cannot be easily shut down; if one C2 address is disabled, they can simply publish a new one on the blockchain.
Propagation: Once a machine is compromised, the malware uses stolen credentials (e.g., npm and GitHub tokens, Open VSX access) to publish more infected packages or compromise legitimate repositories, propagating the worm.
The "Zombie" RAT: A sophisticated backup mechanism, disguised as a link in a Google Calendar, delivers a heavily obfuscated and encrypted Remote-Access-Trojan (RAT).
RAT Functionality: The RAT turns the infected machine into a SOCKS proxy server, granting attackers access to the victim's internal network traffic. Control is executed via Peer-to-Peer connections using WebRTC, with commands distributed via BitTorrent for added decentralization.
Scope and Risk (21.10.2025): The malware was discovered on October 17, 2025. Koi identified seven initially infected extensions, rapidly increasing the count across both marketplaces to a total of 35,800 installations. Users who installed affected packages are considered compromised.