The GlassWorm campaign has resurfaced within the developer community, though the adversaries have adopted a more surreptitious operational profile. Rather than disseminating overtly malicious extensions via OpenVSX, they initially publish innocuous facsimiles of popular...
Yet another devastating supply chain bombardment has struck at the heart of ubiquitous developmental instruments. On this occasion, digital marauders surreptitiously injected malignant code into the GitHub Action of Checkmarx’s KICS project—a sovereign architecture...
Popular IDEs with AI assistants—such as Cursor, Windsurf, Google Antigravity, and Trae—have been found vulnerable to a supply-chain attack. These environments prompt users to install extensions that are absent from the OpenVSX catalog. The...
The Glassworm campaign targeting popular Visual Studio Code extensions has entered yet another phase — researchers are now documenting a third wave of malicious uploads to the OpenVSX repository and the Microsoft Visual Studio...
Several extensions for Visual Studio Code, distributed via the open OpenVSX repository, have been found to contain malicious code aimed at cryptocurrency theft and the compromise of developers’ machines. The campaign is attributed to...
