https://pwn.watch/t/openvsx Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 31 Oct 2025 00:00:00 GMT https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025 https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025 Fri, 31 Oct 2025 00:00:00 GMT high <p>Koi Security found extensions on OpenVSX (and one on Microsoft's marketplace) carrying JavaScript hidden in invisible Unicode variation selectors. The malware stole npm, GitHub, Git and OpenVSX credentials to infect more extensions, went after crypto wallets, and set up SOCKS proxies and hidden VNC.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Malicious releases removed from the marketplaces</p> <p><strong>Latest updates:</strong></p><ul><li>2025-10-20: Wider coverage; Microsoft marketplace extension also affected (<a href="https://www.bleepingcomputer.com/news/security/self-spreading-glassworm-malware-hits-openvsx-vs-code-registries/">source</a>)</li><li>2025-10-17: Koi Security discloses GlassWorm on OpenVSX (<a href="https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace">source</a>)</li></ul>