Malicious VS Code Extensions: GlassWorm and Crypto Theft

Video transcript

VS Code extensions run with your editor's own permissions. A fake or hijacked one can steal wallet data and developer tokens.

GlassWorm has spread through Open VSX extensions since October 2025. It hid code in invisible Unicode, took orders from Solana transactions, stole developer credentials and wallet data, and added remote access.

Researchers have tracked several waves, including 73 sleeper extensions that looked benign at upload. The Eclipse Foundation, which runs Open VSX, says bots inflated download counts.

Other campaigns target crypto developers too. A blockchain developer lost about 500,000 dollars to a fake Solidity extension for Cursor, Kaspersky reported.

Microsoft says an extension can read and write files, make network requests and run external processes, like any program you run.

Inventory extensions by full ID, and check published lists. If a bad one ran, isolate the machine. Then, from a clean device, rotate tokens and SSH keys and move wallet funds.

Since version 1.96, VS Code lets admins enforce an extension allowlist. Allow by extension ID, pin versions, and sign on a dedicated device with no editor or extensions.

Guardian's Managed Security covers 118 controls across nine security domains, including devices and secrets. An engineer confirms any exposure and works with you on the fix.

Read the full article for indicators to hunt and a sample allowlist. Or talk to Guardian at guardian.security.

A developer's machine holds what attackers want: source code, SSH keys, npm and GitHub tokens, and often wallets.

Since October 2025, the GlassWorm campaign has reached those machines through VS Code extensions on Open VSX. Other groups have drained wallets with fake Solidity extensions.

This guide covers what happened, how extensions run code, what to hunt for and the extension policy that stops it.

What Happened With GlassWorm

Koi Security found GlassWorm after its risk engine flagged the CodeJoy extension, iTnews reported. Researchers have tracked several waves:

How the first wave worked

• Hidden code: Unicode variation selectors that do not render, so reviewers saw blank space.
• Command and control: base64 data in Solana transaction memos, with Google Calendar as a backup.
• Theft: npm, GitHub, Open VSX and git credentials, plus data from 49 wallet extensions.
• Remote access: a module called ZOMBI added SOCKS proxies and hidden VNC.

Targeted wallets included MetaMask and Phantom. The stolen publishing credentials let the campaign spread to more extensions, per iTnews.

Koi linked the operator to a Russian-speaking actor, Security Affairs reported.

What Open VSX says

The Eclipse Foundation, which runs Open VSX, says the token leaks "were caused by developer mistakes, not a compromise of the Open VSX infrastructure."

It disputes the worm label: GlassWorm was "not a self-replicating worm in the traditional sense." It also says the reported 35,800 downloads overstate affected users, because bots inflated them.

It declared the incident contained on October 21, 2025, and revoked the affected tokens.

It planned shorter token lifetimes and scanning at publication time.

Later waves

The December macOS wave copied the login Keychain, targeted over 50 browser wallet extensions and took GitHub and npm tokens and SSH files, Koi found.

It also carried code to replace Ledger Live and Trezor Suite with trojanized versions. Koi calls that "an observed code capability, not a confirmed successful deployment."

The April 2026 sleepers cloned real listings, in one case reusing the real icon. They looked benign at upload; Socket says the payload arrives in a later update.

Other Attacks on Crypto Developers

GlassWorm is not the only campaign aimed at crypto developers' editors.

• Fake Solidity extension: a blockchain developer lost about $500,000 after installing one for Cursor from Open VSX (Kaspersky, July 2025).
• WhiteCobra: 24 extensions across Open VSX and the VS Code Marketplace, aimed at VS Code, Cursor and Windsurf (Koi, September 2025).
• Contagious Interview: North Korea-linked repos whose VS Code tasks run on folder open once trusted (Jamf, January 2026).

The fake Solidity extension showed 54,000 downloads, inflated to outrank the real one. It installed ScreenConnect, then a backdoor and a stealer, Kaspersky says.

Koi ties WhiteCobra to that theft. Separately, Ethereum core developer Zak Cole described a wallet drain after using contractshark.solidity-lang, a Solidity extension on Open VSX, BleepingComputer reported.

The North Korean repos are coding tests from fake recruiters; see fake job interview malware and the Lazarus Group playbook.

How Editor Extensions Run Code

Microsoft's documentation is direct: "The extension host has the same permissions as VS Code itself."

An extension can read and write files, make network requests and run external processes. Installing one is like running a program as yourself.

The VS Code Marketplace adds checks:

• A malware scan on every package before it is published.
• A verified check mark for publishers who prove domain ownership.
• A prompt to trust a third-party publisher on first install.
• A block list: removed extensions are uninstalled automatically.

WhiteCobra still got eight extensions onto the VS Code Marketplace. Downloads, ratings and reviews can be gamed, Koi warns.

Workspaces add a second path. A repo's tasks can be set to run on folder open, but VS Code says automatic tasks "never run in an untrusted workspace."

Detection and IOCs

Start with an inventory. Record each extension's full publisher ID and version on every developer machine, and match full IDs, not display names, as Koi advises.

Check the rest against the published lists, including Socket's 73 sleepers. Then hunt for behavior:

• AppleScript or new LaunchAgents started from an editor (Koi).
• Unexpected reads of Keychain, .npmrc or ~/.ssh (Koi).
• Background editor tasks piping curl into a shell (GitLab).

If one ran, treat it as an incident. Koi says removing the extension alone is not enough.

Isolate the machine, then rotate tokens and SSH keys from a clean system. Move wallet funds from a clean device too, as our guide to a private key exposed on GitHub sets out.

Extension Policy for Crypto Teams

Allowlist extensions

Since version 1.96, VS Code supports an extensions.allowed setting. Admins can enforce it with the AllowedExtensions policy, which overrides user settings.

"extensions.allowed": {
  "microsoft": true,
  "dbaeumer.vscode-eslint": ["3.0.0"]
}

• Allow by extension ID, not just publisher, for anything outside your core vendors.
• Pin versions, so an update cannot slip in unreviewed. Each version is listed individually.
• VS Code disables installed extensions that the list blocks.
• Using a VS Code fork? Confirm which marketplace it pulls from and how it enforces policy.

Check publishers

• Prefer verified publishers with a public repository and history.
• Distrust new extensions with sudden downloads and glowing reviews (Koi).
• Search by full ID; the fake Solidity extension outranked the real one.
• Re-review on every update; the April sleepers turned malicious later.

Separate signing and secrets

• Sign on a dedicated device with no editor, no extensions and no outside code.
• Keep wallets with funds off development machines and browsers.
• Keep keys out of .env files; use encrypted keystores or hardware wallets.
• Use short-lived tokens and trusted publishing; see dApp supply chain security.
• Open outside repos untrusted, and keep automatic tasks off.

How Guardian Helps

Guardian's Managed Security covers nine operational security domains and 118 controls, including devices, secrets and the pipeline that ships your code.

It also matches disclosures against what you run, and an engineer confirms any exposure and works with you on the fix.

An OpSec Audit maps every path to your funds, including access across every system and secrets handling.

Frequently Asked Questions

What is GlassWorm?

A malware campaign Koi Security found in Open VSX extensions in October 2025. It hid code in invisible Unicode characters, used Solana transactions for command and control, and stole developer credentials and crypto wallet data.

Are VS Code extensions sandboxed?

Not from your files. Microsoft says the extension host has the same permissions as VS Code itself, so an extension can read and write files, make network requests and run external processes.

How do I allowlist VS Code extensions?

Use the extensions.allowed setting, available from VS Code 1.96, or deploy the AllowedExtensions policy. Allow by publisher or extension ID and pin versions. VS Code disables installed extensions the list blocks.

What should I do if I installed a malicious extension?

Treat it as an incident. Isolate the machine, then from a clean device move wallet funds and rotate GitHub, npm and cloud tokens and SSH keys. Removing the extension alone is not enough.

Sources

• iTnews: Hidden "Glassworm" malware spreads through infected VS Code extensions (October 22, 2025)
• Eclipse Foundation: Open VSX Security Update, October 2025 (October 27, 2025)
• Security Affairs: GlassWorm malware has resurfaced on the Open VSX registry (November 10, 2025)
• Koi Security, on the Palo Alto Networks blog: GlassWorm Goes Mac, Fresh Infrastructure, New Tricks (December 29, 2025, republished October 1, 2026)
• BleepingComputer: GlassWorm malware attacks return via 73 OpenVSX sleeper extensions (April 27, 2026)
• Kaspersky: How installing a fake extension from Open VSX led to cryptocurrency theft (July 10, 2025)
• Kaspersky: Kaspersky uncovers $500K crypto heist through malicious packages targeting Cursor developers (July 10, 2025)
• BleepingComputer: WhiteCobra floods VSCode market with crypto-stealing extensions (September 13, 2025)
• The Hacker News: North Korea-Linked Hackers Target Developers via Malicious VS Code Projects (January 20, 2026)
• GitLab: How to detect and prevent Contagious Interview IDE attacks (May 4, 2026)
• Visual Studio Code Docs: Extension runtime security
• Visual Studio Code Docs: Manage extensions in enterprise environments
• Visual Studio Code Docs: Workspace Trust
• Visual Studio Code Docs: Tasks
• Guardian: Managed Security
• Guardian: OpSec Audit