Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX

Socket discovered a cluster of malicious and high-risk VS Code extensions linked to the GlassWorm supply chain campaign, spanning both the Visual Studio Marketplace and Open VSX. Two confirmed malicious extensions—Aurora Nocturne Night Theme and Cosmic Nebula Themes—were found to deploy JavaScript-based malware loaders that execute obfuscated code, exfiltrate data, and dynamically resolve follow-on payloads via Solana blockchain transaction memos. The threat actor used deceptive tactics including brandjacking, code obfuscation, and Git history manipulation to distribute malicious themes. The campaign avoids Russian systems and has reused infrastructure, code patterns, and publisher identities across multiple extensions, indicating coordinated activity. Although some extensions are no longer weaponized, they retain dangerous executable capabilities and are assessed as high-risk due to their development lineage.

AI-extracted · verify before operational use