Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX
GlassWorm-linked VS Code extensions found on marketplaces contain malware loaders.
Socket has identified a cluster of VS Code extensions, including themes, linked to the GlassWorm threat actor. Two extensions, 'Coca-Cola Christmas' and 'Aurora Borealis Studio Theme', were found on the Visual Studio Marketplace, with 'Cosmic Nebula Themes' on Open VSX confirmed as malicious. These extensions contain malware loaders that can decrypt and execute malicious JavaScript, with 'Cosmic Nebula Themes' exhibiting advanced techniques like using Solana transaction memos for C2 infrastructure resolution and employing Russian-language/timezone gating. The cluster has thousands of installs across both marketplaces, posing a significant risk despite some extensions not currently being weaponized.
AI summary of the linked source. Not reviewed by an editor. How this works
Run VS Code Marketplace?
Get an email when a new story names VS Code Marketplace, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors linked to GlassWorm embedded malware loaders inside seemingly benign VS Code theme extensions, exploiting developer trust in popular marketplaces like Visual Studio Marketplace and Open VSX. The extensions used advanced obfuscation techniques, including decrypting and executing malicious JavaScript at runtime and leveraging Solana blockchain transaction memos for command-and-control resolution, making detection significantly harder. This attack highlights the growing risk of supply chain compromise through developer tooling ecosystems, where aesthetic or utility packages receive less scrutiny than functional libraries. With thousands of installs across both platforms, even extensions not yet 'weaponized' represent a latent threat that could be activated remotely. The incident underscores that any third-party extension, regardless of perceived harmlessness, can serve as an initial access vector.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — fingercakes4sale[.]store
- url — hxxps://fingercakes4sale[.]store/dsyuC
- hash_sha256 — a276b76d3b00f302bb4dfb3690125c85ff472b16049c3c37476ac5e51096df07
- hash_sha256 — 5e68ca8c2097caccdb74d2752b85b85595a4bf646b442b8431a2416e87dbf268
- domain — api.mainnet-beta.solana[.]com
- hash_sha256 — 684c877a52d226d50584cb886ca8ec5bec6355d4de853f406734c79d5b387804
- hash_sha256 — da2d950e50326171adbff9c2bfd6f28998e32623ea7c2c475b9159a45cfb86bb
- mitre_attack — T1195.002
- mitre_attack — T1027
- mitre_attack — T1140
- mitre_attack — T1105
- mitre_attack — T1102.001
- mitre_attack — T1059.007
- mitre_attack — T1059.003
- mitre_attack — T1614.001