Listen to this Post
Introduction:
The rise of open-source extension marketplaces has revolutionized developer productivity, but it has also created a sprawling attack surface for threat actors. In a sophisticated new campaign, the GlassWorm adversary—previously known for weaponizing invisible Unicode characters inside npm packages—has pivoted to distributing a persistent Remote Access Trojan (RAT) through the OpenVSX registry, directly compromising developers using VS Code, Cursor, and Windsurf. This attack demonstrates how supply chain vulnerabilities now target not just dependencies but the very tools developers trust to write code.
Learning Objectives:
- Understand the technical mechanics of how malicious OpenVSX extensions execute GlassWorm RAT payloads across multiple IDEs.
- Learn to detect and remove compromised extensions using command-line audits, file integrity checks, and network monitoring.
- Implement defensive measures including registry filtering, extension allowlisting, and runtime behavioral analysis for Linux and Windows environments.
You Should Know:
1. Anatomy of the GlassWorm OpenVSX Attack Chain
The GlassWorm campaign leverages the OpenVSX registry—an open-source alternative to Microsoft’s Visual Studio Marketplace—to host seemingly legitimate extensions. Once a developer installs the malicious extension, it executes a multi-stage payload that deploys a persistent RAT. Below is the step-by-step breakdown of the attack flow and how to replicate detection techniques in a sandbox.
Step‑by‑step guide – Attack simulation & detection:
- Extension Installation – The attacker publishes an extension (e.g., “Advanced Theme Pack” or “Debugger Helper”) with a malicious `package.json` containing a `postinstall` script.
Detection command (Linux/macOS):
grep -r "postinstall" ~/.vscode/extensions//package.json | grep -E "curl|wget|base64|eval"
Windows (PowerShell):
Get-ChildItem -Path "$env:USERPROFILE.vscode\extensions" -Recurse -Filter "package.json" | Select-String "postinstall" -Context 0,5 | Select-String "curl|wget|base64|eval"
- Payload Download – The script fetches a staged binary from a remote C2 (e.g., `https://cdn[.]glassworm[.]in/payload`).
Monitor outbound connections (Linux):
sudo tcpdump -i eth0 -n 'tcp port 443 and host not <trusted-cdn>' -c 50
- Persistence Mechanism – GlassWorm installs a systemd service (Linux) or a scheduled task (Windows) to survive reboots.
List suspicious systemd services (Linux):
systemctl list-unit-files --type=service | grep -E "glass|worm|update|system-helper"
Windows scheduled tasks:
schtasks /query /fo LIST /v | findstr /i "glassworm"
- RAT Communication – The malware establishes encrypted WebSocket tunnels to exfiltrate source code and keystrokes.
Detect WebSocket anomalies (Linux with `ss`):
ss -tunap | grep -E "ESTAB.:443.websocket|:8080"
- Removal Procedure – Identify and delete the malicious extension folder, then revoke any generated SSH keys.
Linux – list extensions by install date ls -lt ~/.vscode/extensions/ | head -20 Remove suspected extension rm -rf ~/.vscode/extensions/<suspicious-id>
-
Hardening VS Code, Cursor, and Windsurf Against RAT Injections
Modern IDEs share the same underlying Electron framework and extension APIs, making them equally vulnerable. Hardening involves restricting extension sources, disabling automatic updates, and implementing runtime privilege separation.
Step‑by‑step configuration hardening:
- Disable automatic extension updates – Prevents a compromised extension from updating to a more aggressive payload.
VS Code settings.json:
"extensions.autoUpdate": false, "extensions.autoCheckUpdates": false
Cursor equivalent: Set `”cursor.extensions.autoUpdate”: false` in `~/.cursor/settings.json`.
- Restrict OpenVSX registry – Only allow trusted registries.
Open `product.json` (Linux):
sudo nano /usr/share/code/resources/app/product.json
Replace `”extensionsGallery”` section to point to internal mirror, or set `”serviceUrl”: “”` to disable.
- Enable extension signature verification – Use `code –list-extensions –show-versions` and cross-check against known good hashes.
Generate SHA256 of local extension folder:
find ~/.vscode/extensions/ -name ".vsix" -exec sha256sum {} \;
- Network egress filtering – Block all outbound traffic from IDE processes except to corporate proxy.
Linux (using iptables):
sudo iptables -A OUTPUT -p tcp -m owner --uid-owner $(id -u) -j REJECT sudo iptables -I OUTPUT -p tcp -m owner --uid-owner $(id -u) -d 10.0.0.0/8 -j ACCEPT
- Runtime behavioral monitoring – Deploy Falco or Sysmon to detect when an IDE spawns a shell or downloads a binary.
Falco rule example:
- rule: IDE Spawns Shell desc: Detect VS Code launching bash or cmd condition: proc.name in (code, cursor, windsurf) and proc.name in (bash, sh, cmd, powershell) output: Malicious extension activity (user=%user.name cmd=%proc.cmdline) priority: CRITICAL
3. Forensic Indicators of Compromise (IoCs) for GlassWorm
To confirm if your environment has been breached, scan for the following specific artifacts. The GlassWorm RAT uses unique mutexes, file names, and registry keys across operating systems.
Step‑by‑step forensic collection:
- Check for hidden Unicode characters in `package.json` – GlassWorm uses zero-width joiners and directional overrides to obfuscate scripts.
Linux command:
find ~/.vscode/extensions -name "package.json" -exec cat {} \; | grep -P "[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}\x{FEFF}]"
- Look for injected environment variables – The RAT often sets `ELECTRON_RUN_AS_NODE` to escape sandbox.
Windows (Registry):
Get-ItemProperty -Path "HKCU:\Environment" | Select-Object | Where-Object {$_ -match "glassworm|electron"}
3. Analyze persistent cron jobs or launch agents
Linux:
crontab -l | grep -iE "curl|wget|python -c|base64" ls -la ~/Library/LaunchAgents/ macOS for Cursor/Windsurf
- Network IoCs – The C2 domains seen in the wild include
glassworm[.]cloud,telemetry-helper[.]net, and IP185.130.5.253.
Check current connections (Windows netstat):
netstat -ano | findstr "185.130.5.253"
- YARA rule for memory scanning – Detect the RAT’s XOR-decoded payload in IDE processes.
rule GlassWorm_RAT { meta: description = "Detects GlassWorm RAT in memory" strings: $x1 = { 31 C0 83 C0 0A 31 DB 83 C3 14 88 04 08 } // XOR stub $x2 = "GlassWormSession" ascii wide condition: uint16(0) == 0x5A4D or uint16(0) == 0x457F and ($x1 or $x2) }
4. Mitigating Supply Chain Risks in Extension Registries
Organizations must treat extension registries like package repositories—implementing continuous scanning, behavioral analysis, and least-privilege installation policies. Below are actionable controls for both Linux and Windows build pipelines.
Step‑by‑step mitigation strategy:
- Internal extension mirror with malware scanning – Use `openvsx-cli` to mirror only approved extensions.
Clone only vetted extensions openvsx-cli download --namespace pub --extension safe-ext --version 1.0.0 Scan with ClamAV clamscan --recursive --detect-pua=yes ./extensions/
2. Implement extension allowlisting via Group Policy (Windows)
Registry key to disable all external extensions:
[HKEY_CURRENT_USER\Software\Microsoft\VS Code\Extensions] "AllowedExtensions"="Microsoft,ms-python,redhat"
Apply using PowerShell:
New-ItemProperty -Path "HKCU:\Software\Microsoft\VS Code\Extensions" -Name "AllowedExtensions" -Value "Microsoft,ms-python" -PropertyType String
- Runtime containerization of IDE – Run VS Code inside a Docker container or Firejail to isolate extensions.
Firejail profile (Linux):
firejail --net=eth0 --blacklist=~/.ssh --read-only=~/projects code --disable-extensions
- Automated post-install script scanner – Use a pre-commit hook in your dotfiles repo.
.bashrc alias for code code() { /usr/bin/code "$@" for ext in ~/.vscode/extensions/; do if grep -q "postinstall" "$ext/package.json"; then echo "WARNING: Extension $ext has postinstall script" read -p "Remove? (y/n) " -n 1 -r if [[ $REPLY =~ ^[bash]$ ]]; then rm -rf "$ext"; fi fi done } -
API security for internal registries – If you run a private OpenVSX instance, enforce API keys and rate limiting to prevent malicious uploads.
Nginx rate limit config:
limit_req_zone $binary_remote_addr zone=openvsx:10m rate=5r/m;
location /api/v1/extension {
limit_req zone=openvsx burst=2;
proxy_pass http://openvsx-backend;
}
What Undercode Say:
- Extension marketplaces are the new package registries – Without mandatory code signing and runtime sandboxing, every IDE user is a potential RAT victim. GlassWorm proves that malicious extensions bypass traditional antivirus because they execute inside trusted processes.
- Developers must adopt zero-trust for their own toolchains – Scanning `postinstall` scripts, monitoring outbound connections from IDEs, and disabling automatic updates are no longer optional. The attack surface is now the keyboard itself.
The GlassWorm campaign is a wake-up call: the same supply chain attacks that hit npm and PyPI have now fully colonized development environments. Until Microsoft, Cursor, and OpenVSX enforce mandatory extension review with dynamic analysis, the burden falls on individual developers and security teams. Implement the commands and rules above today—your source code may already be leaking.
Prediction:
By Q3 2026, we will see the first major data breach traced directly to a malicious extension installed from a secondary registry like OpenVSX. Attackers will increasingly target “trusted” developers by compromising their extension publishing tokens, leading to automated malware injection into millions of IDE instances. The only sustainable defense will be immutable development containers and AI-driven behavioral monitoring that can distinguish between legitimate tooling and RAT beaconing. Organizations that fail to treat IDE extensions as high-risk binaries will become the next headline.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Varshu25 Malicious – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
