GlassWorm Malware Hits 400+ Code Repos on GitHub, npm, VSCode, and OpenVSX

TamilTech AI summary

GlassWorm is a stealthy supply-chain malware that slipped into over 400 code repositories and packages across GitHub, npm, the VSCode Marketplace, and OpenVSX, so anyone who installs packages, extensions, or clones public repos should take this seriously. It spreads through typosquatting, dependency confusion, stolen maintainer accounts, and lookalike extensions, then fingerprints machines, harvests credentials like SSH keys, AWS secrets, and API tokens, phones home over HTTPS, and tries to stick around via Git hooks and CI/CD. Detection is tough because the payload is obfuscated, often stays dormant, and only activates in certain environments while blending in with normal traffic. GitHub, npm, Microsoft, and OpenVSX have pulled bad packages and accounts and tightened scanning and publisher checks, but you should still audit dependencies with npm audit, review extensions carefully, rotate exposed credentials, enable 2FA, pin versions, and avoid committing secrets. Treat every package and extension as a potential risk, because attacks on developer tools are rising and a single bad install can put your machine and your clients’ systems at risk.

• What is GlassWorm malware?
• How do I know if I installed a GlassWorm-infected package?
• What should I do if I may have been affected?
• Is my VSCode safe to use?

AI-assisted summary, checked by the TamilTech editorial team.