The GlassWorm VS Code Extension Worm

What happened

On 17 October 2025, seven Open VSX extensions received poisoned updates, with about 35,800 downloads in total, according to Truesec. On 19 October a new infected extension appeared on the Microsoft VS Code marketplace.

The malicious code used invisible Unicode and Private Use Area characters. These characters do not show in a code editor, so a reviewer who reads the source sees nothing. Veracode describes the technique and the two command channels.

The malware looked for payload addresses in a Solana blockchain transaction. A Google Calendar event served as a backup channel. Both use normal public services, which makes the traffic hard to block.

The malware then did several things on the developer machine:

• It collected npm, GitHub and Git credentials.
• It targeted 49 cryptocurrency wallet extensions.
• It started a SOCKS proxy, so the machine could carry criminal traffic.
• It installed a hidden VNC server for full remote access.

This is why it is called a worm. The stolen credentials let the malware publish poisoned versions of other packages and extensions that the victim could update. Veracode names npm tokens, GitHub credentials and Open VSX access tokens as the stolen items.

Affected versions

Truesec lists these extension versions as compromised. Each one was a clean extension before the update.

• Open VSX: codejoy.codejoy-vscode-extension 1.8.3 and 1.8.4
• l-igh-t.vscode-theme-seti-folder 1.2.3
• kleinesfilmroellchen.serenity-dsl-syntaxhighlight 0.3.2
• JScearcy.rust-doc-viewer 4.2.1
• SIRILMP.dark-theme-sm 3.11.4
• CodeInKlingon.git-worktree-menu 1.0.9 and 1.0.91
• ginfuru.better-nunjucks 0.3.2
• ellacrity.recoil 0.7.4
• grrrck.positron-plus-1-e 0.0.71
• jeronimoekerdt.color-picker-universal 2.8.91
• srcery-colors.srcery-colors 0.3.9
• sissel.shopify-liquid 4.0.1
• TretinV3.forts-api-extention 0.3.1
• VS Code Marketplace: cline-ai-main.cline-ai-agent 3.1.3

The worm kept spreading after the first report, so this list is not final. Check any extension you installed or updated in October 2025.

Indicators of compromise

Truesec publishes these indicators. Search your proxy, DNS and endpoint logs for them.

• Primary command server IP: 217.69.3.218
• Exfiltration endpoint: 140.82.52.31:80/wall
• Payload paths on the command server: /get_arhive_npm/ and /get_zombi_payload/
• Solana wallet used as a command channel: 28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2
• Backup channel: a Google Calendar event at calendar.app.google/M2ZCvM8ULL56PD1d6, organizer uhjdclolkdn@gmail.com
• Persistence: new entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run

How to check

List your installed extensions and versions, then compare them with the affected list above.

code --list-extensions --show-versions

The extension folders also hold the files. This command searches them for the primary command server address.

grep -rl "217.69.3.218" ~/.vscode/extensions ~/.vscode-oss/extensions 2>/dev/null

On Windows, also look at the two Run registry keys above for entries you did not create. Check network logs for connections to the listed IP addresses.

What to do now

1. Remove any affected extension version and restart the editor.
2. Treat the machine as compromised if one was installed. The malware installs remote access.
3. Rotate npm tokens, GitHub tokens, Git credentials and Open VSX tokens from a clean machine.
4. Check your wallets for unauthorized activity if you use wallet extensions.
5. Review the packages and extensions you publish for versions you did not release.
6. Keep an inventory of installed extensions, install only from verified publishers, and consider turning off auto-update so you can review changes.

Vigilance compares the version you trust with a new one and reports the file that gained a new capability. See all attacks for other supply chain cases.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 80

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    extension.js
           It now downloads from the internet and reads saved passwords and access keys. It did not before.

Sources

1. truesec.com/hub/blog/glassworm-self-propagating-vscode-extension
2. veracode.com/blog/glassworm-vs-code-extension/