securityweek.com·Apr 28, 2026
More than 70 extensions in the Open VSX marketplace are suspected to be linked to the GlassWorm malware, which is designed to steal sensitive information and credentials. These extensions mimic popular ones to gain trust, with some already activated to deliver malware through future updates.
The key insight for you is the identification of 73 suspicious extensions in the Open VSX marketplace linked to GlassWorm malware, which uses social engineering techniques by cloning popular extensions to gain trust before deploying malicious payloads. This highlights the critical need for enhanced scrutiny of code supply chains and the importance of thorough vetting processes for third-party extensions to mitigate such threats.