GlassWorm Trojan Hits VS Code, Cursor, Windsurf via OpenVSX Extension

A newly discovered supply chain attack is spreading the GlassWorm malware across multiple developer environments by abusing the OpenVSX extension marketplace.

GlassWorm is not new. Researchers have tracked the campaign since March 2025, when attackers hid malicious payloads inside npm packages using invisible Unicode characters.

Since then, the operation has expanded across GitHub repositories, npm libraries, and VS Code extensions.

Security researchers have identified a trojanized extension named “code-wakatime-activity-tracker” that impersonates the legitimate WakaTime plugin while secretly deploying a multi-stage infection chain targeting popular IDEs like Visual Studio Code, Cursor, and Windsurf.

More recently, it delivered a persistent remote access trojan (RAT) via a fake Chrome extension that logged keystrokes and stole session cookies. This latest variant marks a significant evolution in delivery technique and scale.

Trojanized Extension Behavior

At first glance, the malicious OpenVSX extension looks nearly identical to the real WakaTime tool.

It includes the same interface elements, API prompts, and functionality expected by developers. The malicious behavior is triggered inside its activation routine.

When the extension loads, it immediately executes a bundled native binary compiled using Zig. This binary is packaged as a Node.js native addon, allowing it to run outside JavaScript sandbox restrictions with full operating system access.

On Windows, it loads a DLL file, while on macOS, it uses a Mach-O binary supporting both Intel and ARM architectures.

Instead of acting as the final payload, the binary serves as a stealthy loader. Its primary role is to deploy the next stage of the GlassWorm infection chain without raising suspicion.

Once executed, the binary scans the system for installed development environments that support VS Code extensions. This includes:

• Visual Studio Code and VS Code Insiders.
• Cursor and Windsurf.
• VSCodium and Positron.

The malware then downloads a malicious .vsix package from a GitHub Releases repository controlled by the attacker.

This package impersonates a widely used extension called “Auto Import,” increasing the likelihood of trust and execution.

Using each IDE’s built-in command-line installer, the malware silently installs the malicious extension across all detected editors.

For example, on Windows it executes commands via cmd.exe to deploy the payload without user interaction. After installation, it deletes the downloaded file to remove forensic traces.

This approach allows a single compromised extension to infect every compatible IDE on a developer’s machine, significantly amplifying the attack’s reach.

Second-Stage Payload

The installed extension acts as a GlassWorm dropper. It connects to a command-and-control infrastructure that leverages blockchain-based mechanisms, specifically using the Solana network.

The malware is designed to avoid infecting systems in certain regions, such as Russia, indicating deliberate targeting.

Once active, it can exfiltrate sensitive data, deploy additional malware, and install persistent access mechanisms. Previous versions have included RAT capabilities and browser-based credential theft via malicious Chrome extensions.

Security experts warn that systems with the “code-wakatime-activity-tracker” extension or unknown “autoimport” plugins should be considered compromised.

Recommended actions include:

• Immediately removing suspicious extensions from all IDEs.
• Rotating API keys, credentials, and authentication tokens.
• Scanning systems for persistence mechanisms and unauthorized binaries.
• Monitoring outbound connections for suspicious activity.

This campaign highlights the growing risk of supply chain attacks targeting developer tools.

By leveraging trusted ecosystems like OpenVSX and GitHub, attackers can quietly distribute malware at scale, turning everyday development environments into entry points for deeper compromise.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.