Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware
Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware
https://thehackernews.com/2026/04/researchers-uncover-73-fake-vs-code.html
Publish Date: 2026-04-27 07:23:00
Source Domain: thehackernews.com
Cybersecurity researchers have flagged dozens of Microsoft Visual Studio Code (VS Code) extensions on the Open VSX repository that are linked to a persistent information-stealing campaign dubbed GlassWorm.
The cluster of 73 extensions has been identified as cloned versions of their legitimate counterparts. Of these, six have been confirmed to be malicious, with the remaining acting as seemingly harmless sleeper packages to get users to download them and build trust, before their true intent is manifested through a subsequent update.
All the extensions were published at the start of the month, per application security company Socket, which is tracking the latest iteration under the moniker GlassWorm v2. In total, more than 320 artifacts have been identified since December 21, 2025. The list of extensions identified as malicious is listed below –
- outsidestormcommand.monochromator-theme
- keyacrosslaud.auto-loop-for-antigravity
- krundoven.ironplc-fast-hub
- boulderzitunnel.vscode-buddies
- cubedivervolt.html-code-validate
- winnerdomain17.version-lens-tool
The cloned sleepers, besides typosquatting the names of the original packages (CEINTL.vscode-language-pack-tr vs. Emotionkyoseparate.turkish-language-pack), use the same icon and description as their corresponding legitimate versions in an attempt to fool unsuspecting developers and trick them into installing the extensions.
This “visual trust” acts as an effective social engineering tactic to boost install counts organically before it’s poisoned to serve malware to the downstream users.
The disclosure comes as the threat actors behind the campaign are actively evolving their modus operandi, pivoting to sleeper packages and transitive dependencies to evade detection, while simultaneously using Zig-based droppers to deploy a secondary VSIX extension hosted on GitHub that can infect all integrated development environments (IDEs) on a developer’s…
