---
title: "GlassWorm: Invisible-Unicode Malware in Open VSX Extensions"
url: https://erroneo.us/security/briefs/glassworm-open-vsx-extension-malware/
description: "Since Oct 2025, GlassWorm has pushed credential-stealing, RAT-laden extensions to Open VSX (72+ more in 2026). Fork users: audit extensions, rotate tokens."
type: security-brief
section: "Security Digest"
date_published: 2025-10-17
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: []
severity: "high"
exploited: "in-the-wild"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# GlassWorm: Invisible-Unicode Malware in Open VSX Extensions

**Verdict: Check exposure.** This is a recurring campaign rather than a single event; developers on VS Code forks that pull from Open VSX should audit installed extensions and auto-updates, while most stock VS Code users with mainstream extensions were not affected.

- **Who must act:** Developers using Cursor, Windsurf, VSCodium, Gitpod/Theia or other Open VSX-backed editors who installed any listed extension, or any lookalike 'AI assistant' extension from an unfamiliar publisher.
- **Who can relax:** Stock VS Code users who never installed the single affected Marketplace extension (cline-ai-main.cline-ai-agent 3.1.3) and stick to verified publishers face little exposure.
- **Affected:** Oct 2025 wave: codejoy.codejoy-vscode-extension 1.8.3, 1.8.4; l-igh-t.vscode-theme-seti-folder 1.2.3; CodeInKlingon.git-worktree-menu 1.0.9, 1.0.91; ginfuru.better-nunjucks 0.3.2; ellacrity.recoil 0.7.4; grrrck.positron-plus-1-e 0.0.71 and others (Open VSX); cline-ai-main.cline-ai-agent 3.1.3 (VS Code Marketplace); 2026 waves: at least 72 more Open VSX extensions since Jan 31, 2026, e.g. gvotcha.claude-code-extension, mswincx.antigravity-cockpit, turbobase.sql-turbo-tool
- **Fixed:** Malicious extensions removed from Open VSX and the VS Code Marketplace; leaked publisher tokens revoked; Some hijacked extensions republished clean by their owners
- **CVEs:** none
- **CISA KEV:** no · **Exploitation:** Exploited in the wild

## What to do

1. List installed extensions in every editor and compare against published GlassWorm IOC lists
2. Uninstall matching extensions and any unknown dependency pulled in via extensionPack/extensionDependencies
3. Rotate GitHub, npm and Open VSX tokens, SSH keys and any secrets on the machine; move crypto wallet funds if wallet extensions were present
4. Rebuild the workstation if a matching extension version ran, since the payload installs a SOCKS proxy and hidden VNC
5. Restrict editors to an allowlist of extensions and turn off auto-update for low-trust publishers

### How to check if you are affected

- code --list-extensions --show-versions (also cursor/codium) | grep -iE 'codejoy|seti-folder|git-worktree-menu|better-nunjucks|recoil|positron-plus|cline-ai-agent|claude-code-extension|antigravity-cockpit'
- grep -rlP '[\x{FE00}-\x{FE0F}\x{E0100}-\x{E01EF}]' ~/.vscode/extensions ~/.cursor/extensions ~/.vscode-oss/extensions
- Network: connections to 217.69.3[.]218, Solana RPC lookups or Google Calendar API calls from editor processes

## What happened

On October 17, 2025, seven extensions on Open VSX, the extension registry used by VS Code forks such as Cursor, Windsurf and VSCodium, began shipping malicious updates. More followed over the next few days. Koi Security named the campaign GlassWorm. Its hallmark is JavaScript hidden in invisible Unicode variation-selector characters, which render as blank space in editors and diffs. Per [BleepingComputer's report on Koi's findings](https://www.bleepingcomputer.com/news/security/self-spreading-glassworm-malware-hits-openvsx-vs-code-registries/), the loader gets next-stage URLs from transactions on a hard-coded Solana wallet, with a Google Calendar event title as backup. It steals GitHub, npm and Open VSX credentials and data from 49 crypto-wallet extensions. It also installs a SOCKS proxy and hidden VNC, turning the developer's machine into a remote-controlled node. Koi counted at least 11 infected Open VSX extensions plus one on Microsoft's Marketplace (`cline-ai-main.cline-ai-agent` 3.1.3), and about 35,800 installs.

The Eclipse Foundation, which runs Open VSX, gave its [own account](https://blogs.eclipse.org/post/mikaël-barbero/open-vsx-security-update-october-2025). Earlier in October, Wiz had found publisher tokens that developers leaked in public repositories, and the attackers used some of them. The Foundation disputes two of Koi's claims. It says GlassWorm was "not a self-replicating worm in the traditional sense", and that the 35,800 figure is inflated by bot downloads. It declared the incident contained on October 21, 2025, and announced shorter token lifetimes, a scannable token prefix, faster revocation, and publish-time scanning. [BleepingComputer](https://www.bleepingcomputer.com/news/security/open-vsx-rotates-tokens-used-in-supply-chain-malware-attack/) notes that Wiz found more than 550 leaked secrets across the two marketplaces.

The campaign did not stop. Socket reported at least 72 more malicious Open VSX extensions published since January 31, 2026 ([The Hacker News](https://thehackernews.com/2026/03/glassworm-supply-chain-attack-abuses-72.html)). Many posed as AI coding tools, for example `gvotcha.claude-code-extension` and `mswincx.antigravity-cockpit`. A new trick arrived with them: a benign-looking extension later adds a GlassWorm extension to its `extensionPack` or `extensionDependencies` field, so the editor installs the malware automatically on update. Aikido tied the same invisible-Unicode technique to at least 151 GitHub repositories in early March 2026, and to npm packages.

## Who is affected

October 2025 versions named in public reporting include `codejoy.codejoy-vscode-extension` 1.8.3/1.8.4, `l-igh-t.vscode-theme-seti-folder` 1.2.3, `CodeInKlingon.git-worktree-menu` 1.0.9/1.0.91, `ginfuru.better-nunjucks` 0.3.2, `ellacrity.recoil` 0.7.4, `grrrck.positron-plus-1-e` 0.0.71, `jeronimoekerdt.color-picker-universal` 2.8.91 and `srcery-colors.srcery-colors` 0.3.9. Many 2026 extensions impersonated popular linters, formatters and AI tools under unfamiliar publisher names. Exposure is concentrated among users of VS Code forks, since those editors default to Open VSX.

## Do you really need to act?

For most developers, a quick audit is enough. The named extensions are niche, and Microsoft's Marketplace had only one confirmed hit in the original wave. But editor extensions run with your full user privileges, auto-update silently, and sit next to SSH keys, cloud CLIs and git credentials. If a matching version was installed, treat it like any infostealer plus RAT infection. The ongoing waves matter most for teams that let developers install anything from Open VSX into AI-assisted forks. A fake "Claude Code" or "Antigravity" extension from an unknown publisher is the current lure.

## What to do now

1. Inventory every editor: `code --list-extensions --show-versions`, and the same with `cursor` or `codium`. Compare against the IOC lists from Koi, Socket and Aikido.
2. Uninstall matches, plus any extension you do not recognize that arrived as a pack or dependency.
3. If a malicious version ran, rotate GitHub PATs, npm and Open VSX tokens and SSH keys, move crypto funds, and rebuild the machine. The payload installs remote-access components.
4. Publishers: revoke and reissue marketplace tokens, scan repos for leaked tokens, and use short-lived tokens.
5. Organizations: enforce an extension allowlist (VS Code supports allowed-extensions policies) and prefer verified publishers.

## How to tell if you were hit

Search extension directories for variation-selector characters, for example with `grep -rlP '[\x{FE00}-\x{FE0F}\x{E0100}-\x{E01EF}]' ~/.vscode/extensions ~/.cursor/extensions`. Expect some false positives from emoji-heavy themes, so review any matches. Watch for editor processes contacting `217.69.3[.]218`, Solana RPC endpoints or the Google Calendar API, and for unexpected SOCKS listeners or VNC processes. Check GitHub and npm audit logs for token use from unfamiliar IPs.

## Timeline

- Oct 17, 2025 — Seven Open VSX extensions push malicious updates; more follow over the next days.
- Oct 20, 2025 — Koi's findings reported widely; Microsoft removes the Marketplace extension.
- Oct 21, 2025 — Open VSX declares the incident contained; tokens revoked.
- Oct 27, 2025 — Eclipse Foundation publishes its security update, disputing the worm label.
- Mar 13, 2026 — Socket reports 72+ new GlassWorm extensions since Jan 31, 2026, using extensionPack chaining.

## Sources

1. [Eclipse Foundation — Open VSX security update, October 2025](https://blogs.eclipse.org/post/mikaël-barbero/open-vsx-security-update-october-2025)
2. [BleepingComputer — Self-spreading GlassWorm malware hits OpenVSX, VS Code registries](https://www.bleepingcomputer.com/news/security/self-spreading-glassworm-malware-hits-openvsx-vs-code-registries/)
3. [BleepingComputer — Open VSX rotates tokens used in supply chain malware attack](https://www.bleepingcomputer.com/news/security/open-vsx-rotates-tokens-used-in-supply-chain-malware-attack/)
4. [The Hacker News — GlassWorm supply chain attack abuses 72 Open VSX extensions](https://thehackernews.com/2026/03/glassworm-supply-chain-attack-abuses-72.html)

---
Source page: https://erroneo.us/security/briefs/glassworm-open-vsx-extension-malware/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt