GlassWorm, reported in October 2025, is described by Veracode as the first self-propagating worm targeting VS Code extensions. It hid code in invisible Unicode characters, stole npm, GitHub and Git credentials, and used them to compromise more packages and extensions. At least 35,800 installations were confirmed compromised.
What it did
According to Veracode's summary of the research by Koi Security, the malware used invisible Unicode and Private Use Area characters, so the malicious code appeared to vanish in editors during review. It spread on both the Open VSX and Microsoft VS Code marketplaces. Because extensions update automatically by default, users received malicious versions with no action.
It harvested npm, GitHub and Open VSX tokens, and used them to compromise more packages and extensions, so each victim could infect others. It also targeted 49 cryptocurrency wallet types, deployed a SOCKS proxy, installed a hidden VNC server through a remote access tool and did reconnaissance on internal systems.
For command and control it placed payload URLs in Solana blockchain transaction memos, which is hard to take down, and used Google Calendar as a backup channel. Veracode links it to the Shai Hulud npm worm found about a month earlier.
Why this is hard to catch by eye
A code review depends on what a person sees. Invisible characters hide content in plain sight. Diff tools that show raw bytes, or linters that flag unusual Unicode, can reveal what the editor hides.
Defences listed by the researchers
Veracode's recommended actions are to audit installed extensions against known compromised lists, install only from verified publishers, review updates especially from inactive projects, rotate npm and GitHub tokens if you used a possibly affected extension, monitor for unauthorized wallet activity and consider turning off auto-update in favour of manual review.
A practical editor hygiene plan
- Keep an inventory of extensions per developer machine and per team.
- Allow only an approved list, and add to it through a short review.
- Disable automatic extension updates on machines with access to production or signing keys.
- Scan source for invisible and bidirectional Unicode characters in pull requests.
- Keep developer tokens short lived and scoped, so one stolen token reaches little.
- When a bad extension is reported, rotate tokens first, then clean the machine.
- Separate crypto wallet browser profiles from developer machines.
See also malicious browser and IDE extensions and the Shai Hulud npm worm.
Where Safeguard fits
Safeguard provides IDE extensions for VS Code, JetBrains and Open VSX, and dependency scanning and policies for the packages your code pulls in. It does not replace marketplace vetting. A free scan is at gold.safeguard.sh/scan.
Quick check
How did GlassWorm hide its code?
It used invisible Unicode and Private Use Area characters, so the code appeared to vanish in editors during review.
Why did users get infected without acting?
VS Code extensions update automatically by default, so malicious versions were delivered through normal updates.
Sources
Last reviewed: 19 October 2026.
