Open VSX

Summary

A threat actor compromised a publisher account on the Open VSX marketplace and uploaded malicious updates to four legitimate VS Code extensions that together had over twenty-two thousand downloads. The poisoned extensions contained a runtime loader that checks for macOS, avoids systems with Russian locales, pulls command‑and‑control instructions from Solana transaction memos, and then deploys a GlassWorm implant that steals browser data, cryptocurrency wallets, keychain information, notes, VPN data and developer credentials such as AWS and SSH keys. The attack used the established publisher identity rather than typosquatting, and analysts attributed the breach to leaked publishing tokens or other unauthorized access.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 30, 2026, a threat actor published malicious versions of four established Visual Studio Code extensions on the Open VSX marketplace after compromising a publisher’s account. The extensions together had accumulated over 22,000 downloads. The malicious code was designed to execute at runtime, evade systems with Russian locales, resolve command‑and‑control data from Solana transaction memos, and run additional payloads. This activity was consistent with prior GlassWorm campaigns but differed from earlier attacks because it did not rely on typosquatting or cloned tools. The compromised publisher maintained a multi‑extension history and had meaningful adoption signals across ecosystems, and also published extensions to the Visual Studio Marketplace, although the incident analysis focused solely on the Open VSX listings.

The threat actor embedded a nearly identical loader in the extension.js file of each malicious extension. The loader first profiles the host system and proceeds only if the operating system checks indicate a macOS environment. Upon passing the OS check, it loads a second‑stage Node.js JavaScript implant intended for data theft and persistence. The implant targets Firefox‑ and Chrome‑based browsers to harvest cookies, form history, login files, and wallet‑extension artifacts, and also searches for Safari cookies, desktop cryptocurrency wallets, the macOS keychain, Apple Notes, and FortiClient VPN data. It then collects documents from the Desktop, Documents, and Downloads folders, stages the harvested information, and prepares it for exfiltration to hardcoded external destinations. Socket reported that the malware specifically seeks developer credentials and configuration such as AWS and SSH information, thereby increasing the risk of account compromise and lateral movement.

The Open VSX security team assessed the incident as consistent with leaked publishing tokens or other unauthorized publishing access. Socket noted that the campaign shows a clear escalation in Open VSX supply chain abuse. Socket also noted that the threat actor blends into normal developer workflows, hides execution behind encrypted, runtime‑decrypted loaders, and uses Solana memos as a dynamic dead drop to rotate staging infrastructure without republishing extensions.

Sources

Sources available to members: 1 source.