GlassWorm Targets Open VSX Marketplace, Uses Solana Blockchain to Conceal Operations

GlassWorm has targeted the VS Code and Open VSX developer ecosystems since October 2025, using stolen publishing tokens to compromise packages and repositories. It uses Solana transaction memos as a command-and-control, or C2, “dead drop,” allowing it to change server locations dynamically. That makes conventional domain blocking and static scanning less effective and heightens the software supply-chain risk.

Socket disclosed on March 13, 2026, that attackers had added at least 72 malicious Open VSX packages since January 31, exploiting extensionPack and extensionDependencies to pass dependencies along and evade review. On May 26, CrowdStrike, Google and Shadowserver disrupted four types of C2 channels. Two more GlassWASM packages were discovered on June 16 and removed after they were reported.