{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T23:39:04.690Z",
  "tag": {
    "id": "glassworm",
    "label": "GlassWorm",
    "isStack": false,
    "url": "https://pwn.watch/t/glassworm",
    "feed": "https://pwn.watch/t/glassworm/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "glassworm-vscode-openvsx-worm-october-2025",
      "title": "GlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible Unicode",
      "url": "https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025",
      "json": "https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "VS Code extensions on OpenVSX and the VS Code Marketplace",
      "tags": [
        "devtools",
        "glassworm",
        "vscode",
        "openvsx",
        "supply-chain",
        "worm",
        "crypto"
      ],
      "cveIds": [],
      "affectedVersions": [
        "e.g. CodeJoy 1.8.3/1.8.4, cline-ai-agent 3.1.3 (Microsoft marketplace) and several OpenVSX extensions (see Koi list)"
      ],
      "fixedVersions": [
        "Malicious releases removed from the marketplaces"
      ],
      "startedAt": "2025-10-17",
      "closedAt": "2025-10-31",
      "updatedAt": "2025-10-31",
      "summary": "Koi Security found extensions on OpenVSX (and one on Microsoft's marketplace) carrying JavaScript hidden in invisible Unicode variation selectors. The malware stole npm, GitHub, Git and OpenVSX credentials to infect more extensions, went after crypto wallets, and set up SOCKS proxies and hidden VNC.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "glassworm-vscode-openvsx-worm-october-2025",
      "incidentTitle": "GlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible Unicode",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-20",
      "title": "Wider coverage; Microsoft marketplace extension also affected",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/self-spreading-glassworm-malware-hits-openvsx-vs-code-registries/",
      "url": "https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025"
    },
    {
      "incident": "glassworm-vscode-openvsx-worm-october-2025",
      "incidentTitle": "GlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible Unicode",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-17",
      "title": "Koi Security discloses GlassWorm on OpenVSX",
      "body": null,
      "sourceUrl": "https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace",
      "url": "https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025"
    }
  ]
}