GlassWorm linked VS Code themes on two marketplaces, per Socket

On 2 October 2026 Socket (Kirill Boychenko) published "Pretty themes, hidden loaders", describing a cluster of theme extensions on the VS Code Marketplace and Open VSX that it links to GlassWorm. Socket says it assesses the analyzed Marketplace build as GlassWorm with high confidence, and that the wider cluster is GlassWorm associated. It adds that this does not establish that every publisher is the same individual.

What happened

Socket's findings, extension by extension:

• microsoftvs.microsoftvs (Aurora Nocturne Night Theme) on the Marketplace: confirmed malicious and since removed. Its manifest activates on every event and hides a Windows downloader that writes a batch file to the temp folder and runs it with cmd.exe.
• cosmic-themes.theme-cosmic-nebula (Cosmic Nebula Themes) on the Marketplace: confirmed malicious. It decrypts an embedded stage and runs it with eval(), exits on a Russian locale or timezone, and reads transaction memos from a Solana address to get a next stage URL. Microsoft removed it and classified it as malware.
• holiday-themes.theme-coca-cola-christmas and lohsebhipolg2s.theme-aurora-borealis: not weaponized in the analyzed versions. Socket cites more than 8,000 Marketplace installs between them and about 39,000 Open VSX downloads for the first.
• Other Open VSX names in the cluster are not confirmed malicious in the article.

Socket notes that VS Code has no granular permission controls for what an extension's code can do. It also puts GlassWorm's earlier disruption on 26 May 2026 by CrowdStrike, Google and Shadowserver, and says that did not remove previously published extensions.

Confirmed, reported and unknown

Reported by Socket from analysis: the loader behavior, the dead drop and the indicators in its post. Removal status is not clear in the article, since one section says the two unweaponized extensions were still available and another says the reported ones were removed.

Unknown: whether the unweaponized themes will get malicious updates (Socket notes they keep executable functionality a color theme does not need), whether the Open VSX build of Cosmic Nebula has the same loader, what the current dead drop payload is, and who operates the cluster.

What to do now

1. List installed extensions on developer machines with code --list-extensions --show-versions and compare against the names above.
2. Search for init.json in user home directories and temp_batch.cmd in temp folders on Windows.
3. Block fingercakes4sale.store at DNS and egress.
4. If a machine ran a confirmed extension, reimage it and rotate credentials stored on it.
5. Remove themes you do not use. A theme with a JavaScript entry point deserves a second look.

How this could have been avoided

• Treat a theme that declares an activationEvents of * and an app.js entry as code, not a color file.
• Keep an approved extension list and enforce it through your editor management tooling.
• Check publisher identity, not name. A listing under a "microsoft" lookalike identity is a signal.
• Reduce what developer machines hold. SSH keys and cloud credentials on the same machine as dozens of extensions raise the cost of one bad theme.
• Deny egress to unfamiliar domains from developer workstations where practical, which would have cut the stage download.

Quick check

Sources

• Socket: Pretty themes, hidden loaders, GlassWorm-linked extensions span VS Code Marketplace and Open VSX