Supply-chain attacksBriefPublic record
GlassWorm, Open VSX / VS Code, Oct 2025 onward
Oct 2025: self-propagating extensions using invisible-Unicode code and Solana/Google Calendar C2.
- Disclosed
What happened
- Oct 2025: self-propagating extensions using invisible-Unicode code and Solana/Google Calendar C2. About 35,800 installs (Koi).
- 2026 waves: - 30 Jan: the oorzc publisher account was hijacked, 4 extensions, 22k downloads. - 31 Jan to 14 Mar: 72 extensions using transitive extensionPack and extensionDependencies. - Apr: 73 “sleeper” clones, 6 or more activated, plus 23 new versions on 29 Apr.
Sources
- https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace
- https://socket.dev/blog/73-open-vsx-sleeper-extensions-glassworm
- https://thehackernews.com/2026/02/open-vsx-supply-chain-attack-used.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.