Digest · Friday

Security digest: October 17, 2025

1 editorial brief and 3 critical advisories.

All digests · RSS · Markdown

Take stock

Check exposure: GlassWorm. Developers using Cursor, Windsurf, VSCodium, Gitpod/Theia or other Open VSX-backed editors who installed any listed extension, or any lookalike 'AI assistant' extension from an unfamiliar publisher.
PyPI: 2 critical advisories (pyquokka, keras). Check with pip-audit (or: pip show <package>).
Maven: 1 critical advisory (net.mingsoft:ms-mcms). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

Oct 17, 2025 · Malicious package

GlassWorm: Invisible-Unicode Malware in Open VSX Extensions

This is a recurring campaign rather than a single event; developers on VS Code forks that pull from Open VSX should audit installed extensions and auto-updates, while most stock VS Code users with mainstream extensions were not affected.

Must act: Developers using Cursor, Windsurf, VSCodium, Gitpod/Theia or other Open VSX-backed editors who installed any listed extension, or any lookalike 'AI assistant' extension from an unfamiliar publisher.

Can relax: Stock VS Code users who never installed the single affected Marketplace extension (cline-ai-main.cline-ai-agent 3.1.3) and stick to verified publishers face little exposure.

List installed extensions in every editor and compare against published GlassWorm IOC lists
Uninstall matching extensions and any unknown dependency pulled in via extensionPack/extensionDependencies
Rotate GitHub, npm and Open VSX tokens, SSH keys and any secrets on the machine; move crypto wallet funds if wallet extensions were present

Read the brief →