GlassWorm: Invisible-Unicode Malware in Open VSX Extensions

What to do

1. List installed extensions in every editor and compare against published GlassWorm IOC lists
2. Uninstall matching extensions and any unknown dependency pulled in via extensionPack/extensionDependencies
3. Rotate GitHub, npm and Open VSX tokens, SSH keys and any secrets on the machine; move crypto wallet funds if wallet extensions were present
4. Rebuild the workstation if a matching extension version ran, since the payload installs a SOCKS proxy and hidden VNC
5. Restrict editors to an allowlist of extensions and turn off auto-update for low-trust publishers

How to check if you are affected or compromised

• code --list-extensions --show-versions (also cursor/codium) | grep -iE 'codejoy|seti-folder|git-worktree-menu|better-nunjucks|recoil|positron-plus|cline-ai-agent|claude-code-extension|antigravity-cockpit'
• grep -rlP '[\x{FE00}-\x{FE0F}\x{E0100}-\x{E01EF}]' ~/.vscode/extensions ~/.cursor/extensions ~/.vscode-oss/extensions
• Network: connections to 217.69.3[.]218, Solana RPC lookups or Google Calendar API calls from editor processes

What happened#

On October 17, 2025, seven extensions on Open VSX, the extension registry used by VS Code forks such as Cursor, Windsurf and VSCodium, began shipping malicious updates. More followed over the next few days. Koi Security named the campaign GlassWorm. Its hallmark is JavaScript hidden in invisible Unicode variation-selector characters, which render as blank space in editors and diffs. Per BleepingComputer's report on Koi's findings, the loader gets next-stage URLs from transactions on a hard-coded Solana wallet, with a Google Calendar event title as backup. It steals GitHub, npm and Open VSX credentials and data from 49 crypto-wallet extensions. It also installs a SOCKS proxy and hidden VNC, turning the developer's machine into a remote-controlled node. Koi counted at least 11 infected Open VSX extensions plus one on Microsoft's Marketplace (cline-ai-main.cline-ai-agent 3.1.3), and about 35,800 installs.

The Eclipse Foundation, which runs Open VSX, gave its own account. Earlier in October, Wiz had found publisher tokens that developers leaked in public repositories, and the attackers used some of them. The Foundation disputes two of Koi's claims. It says GlassWorm was "not a self-replicating worm in the traditional sense", and that the 35,800 figure is inflated by bot downloads. It declared the incident contained on October 21, 2025, and announced shorter token lifetimes, a scannable token prefix, faster revocation, and publish-time scanning. BleepingComputer notes that Wiz found more than 550 leaked secrets across the two marketplaces.

The campaign did not stop. Socket reported at least 72 more malicious Open VSX extensions published since January 31, 2026 (The Hacker News). Many posed as AI coding tools, for example gvotcha.claude-code-extension and mswincx.antigravity-cockpit. A new trick arrived with them: a benign-looking extension later adds a GlassWorm extension to its extensionPack or extensionDependencies field, so the editor installs the malware automatically on update. Aikido tied the same invisible-Unicode technique to at least 151 GitHub repositories in early March 2026, and to npm packages.

Who is affected#

October 2025 versions named in public reporting include codejoy.codejoy-vscode-extension 1.8.3/1.8.4, l-igh-t.vscode-theme-seti-folder 1.2.3, CodeInKlingon.git-worktree-menu 1.0.9/1.0.91, ginfuru.better-nunjucks 0.3.2, ellacrity.recoil 0.7.4, grrrck.positron-plus-1-e 0.0.71, jeronimoekerdt.color-picker-universal 2.8.91 and srcery-colors.srcery-colors 0.3.9. Many 2026 extensions impersonated popular linters, formatters and AI tools under unfamiliar publisher names. Exposure is concentrated among users of VS Code forks, since those editors default to Open VSX.

Do you really need to act?#

For most developers, a quick audit is enough. The named extensions are niche, and Microsoft's Marketplace had only one confirmed hit in the original wave. But editor extensions run with your full user privileges, auto-update silently, and sit next to SSH keys, cloud CLIs and git credentials. If a matching version was installed, treat it like any infostealer plus RAT infection. The ongoing waves matter most for teams that let developers install anything from Open VSX into AI-assisted forks. A fake "Claude Code" or "Antigravity" extension from an unknown publisher is the current lure.

What to do now#

1. Inventory every editor: code --list-extensions --show-versions, and the same with cursor or codium. Compare against the IOC lists from Koi, Socket and Aikido.
2. Uninstall matches, plus any extension you do not recognize that arrived as a pack or dependency.
3. If a malicious version ran, rotate GitHub PATs, npm and Open VSX tokens and SSH keys, move crypto funds, and rebuild the machine. The payload installs remote-access components.
4. Publishers: revoke and reissue marketplace tokens, scan repos for leaked tokens, and use short-lived tokens.
5. Organizations: enforce an extension allowlist (VS Code supports allowed-extensions policies) and prefer verified publishers.

How to tell if you were hit#

Search extension directories for variation-selector characters, for example with grep -rlP '[\x{FE00}-\x{FE0F}\x{E0100}-\x{E01EF}]' ~/.vscode/extensions ~/.cursor/extensions. Expect some false positives from emoji-heavy themes, so review any matches. Watch for editor processes contacting 217.69.3[.]218, Solana RPC endpoints or the Google Calendar API, and for unexpected SOCKS listeners or VNC processes. Check GitHub and npm audit logs for token use from unfamiliar IPs.

Timeline#

• Oct 17, 2025 — Seven Open VSX extensions push malicious updates; more follow over the next days.
• Oct 20, 2025 — Koi's findings reported widely; Microsoft removes the Marketplace extension.
• Oct 21, 2025 — Open VSX declares the incident contained; tokens revoked.
• Oct 27, 2025 — Eclipse Foundation publishes its security update, disputing the worm label.
• Mar 13, 2026 — Socket reports 72+ new GlassWorm extensions since Jan 31, 2026, using extensionPack chaining.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Eclipse Foundation — Open VSX security update, October 2025 blogs.eclipse.org

Coverage and analysis

1. BleepingComputer — Self-spreading GlassWorm malware hits OpenVSX, VS Code registries bleepingcomputer.com
2. BleepingComputer — Open VSX rotates tokens used in supply chain malware attack bleepingcomputer.com
3. The Hacker News — GlassWorm supply chain attack abuses 72 Open VSX extensions thehackernews.com