Oct 17, 2025
1 new incident, 0 with updates.
Started
- ClosedPatched
GlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible Unicode
Koi Security found extensions on OpenVSX (and one on Microsoft's marketplace) carrying JavaScript hidden in invisible Unicode variation selectors. The malware stole npm, GitHub, Git and OpenVSX credentials to infect more extensions, went after crypto wallets, and set up SOCKS proxies and hidden VNC.
VS Code extensions on OpenVSX and the VS Code MarketplaceClosed Oct 31, 2025
