The Trojan Update: How “GlassWorm” Developers are Using Sleeper Extensions to Hijack Workspaces

The GlassWorm campaign has resurfaced within the developer community, though the adversaries have adopted a more surreptitious operational profile. Rather than disseminating overtly malicious extensions via OpenVSX, they initially publish innocuous facsimiles of popular utilities, only to introduce nefarious functionalities later through subsequent updates.

Socket has identified 73 dubious extensions associated with this nascent wave of GlassWorm activity. Six of these have already transitioned to an active state, initiating the deployment of malicious code. The remainder, according to specialist evaluation, are currently dormant or exhibit sufficient structural anomalies to be classified as components of the same orchestrated stratagem.

The extensions achieve deception by meticulously mimicking legitimate projects; by co-opting familiar iconography, nomenclature, and descriptions, they easily deceive the inattentive developer. Discrepancies are typically obscured within the publisher’s name and the unique extension identifier.

This refined tactical approach deviates from prior GlassWorm incursions. Previously, malicious payloads were embedded directly within the extensions, occasionally utilizing invisible Unicode characters for obfuscation. Now, the extensions function primarily as droppers. They possess the capability to fetch supplementary VSIX packages from GitHub, execute platform-specific .node modules, or employ heavily obfuscated JavaScript that reveals its malicious intent only during runtime.

While Socket has refrained from disclosing the granular technical specifics of the recent payload, previous GlassWorm iterations were engineered to scavenge for cryptocurrency wallet data, credentials, access tokens, SSH keys, and the proprietary contents of developer workspaces. The campaign has historically permeated GitHub, npm, the Visual Studio Code Marketplace, and OpenVSX, even targeting macOS users via fraudulent cryptocurrency client software.

Socket has disseminated a comprehensive list of the 73 affected extensions. Developers who have integrated these packages are urged to sanitize their environments and rotate all sensitive secrets, including tokens, cryptographic keys, and administrative passwords.