Post

We’re tracking 73 Open VSX sleeper extensions tied to the GlassWorm campaign, with at least 6 already activated to deliver malware. These cloned extensions initially appear benign, then later become malware delivery vehicles through normal updates. socket.dev/blog/73-open...

socket.dev73 Open VSX Sleeper Extensions Linked to GlassWorm Show New ...Socket is tracking cloned Open VSX extensions tied to GlassWorm, with several updated from benign-looking sleepers into malware delivery vehicles.

Marc Bernard

@marcf.be

25 Apr

Which scanner can detect those?

Socket

@socket.dev

With the sleeper packages it's a mix of automated detections and manual investigation based on different metadata we're tracking related to this activity on the registry.

26/4/26, 3:35 pm0 reposts1 like

No replies yet.