Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX

Socket researchers identified a cluster of Visual Studio Marketplace and Open VSX color-theme extensions linked through shared Git history, near-identical code, Russian-language comments, executable scaffolding, and suspicious branding, including themes named Coca-Cola Christmas, Aurora Borealis Studio Theme, Aurora Nocturne, and Cosmic Nebula. Two extensions were confirmed malicious: Aurora Nocturne Night Theme used a heavily obfuscated Windows downloader to retrieve and silently run a batch file, while Cosmic Nebula Themes decrypted and executed JavaScript that used Russian-system avoidance and Solana transaction memos to locate and run follow-on payloads. Cosmic Nebula’s loader matched known GlassWorm infrastructure and techniques, leading researchers to assess it as GlassWorm with high confidence and the wider cluster as GlassWorm-associated. Although several related extensions did not contain active malware when examined, they retained unnecessary executable capabilities and had accumulated tens of thousands of downloads, prompting reports to marketplace operators and removals by the VS Code Marketplace. The report advises organizations to inspect installed extension packages rather than relying on public repositories, monitor extensions and updates across both registries, and investigate potentially compromised hosts for identified payload, process, and network indicators.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.