Glassworm Malware Abuses npm, PyPI, OpenVSX, GitHub to Target Developers

Key Takeaways

• The Glassworm malware campaign targets software developers by injecting malicious code into popular package registries and development environments.
• Initial infections were observed in October 2025, primarily through compromised VS Code and OpenVSX extensions, affecting an estimated 35,800 developers.
• The multi-stage malware steals credentials, GitHub tokens, and cryptocurrency wallet data, establishing persistent backdoors and exploiting the Solana blockchain for command-and-control.
• Attackers leverage hijacked legitimate npm packages, force-push malware to victim repositories, and employ stealth techniques like invisible Unicode characters to evade detection.
• Organizations and developers must enhance security practices, including multi-factor authentication, credential rotation, and rigorous auditing of extensions and packages.

Glassworm Malware Targets Developer Ecosystems with Sophisticated Supply Chain Attacks

A sophisticated malware operation, identified as Glassworm, is actively compromising the vital tools and platforms upon which software developers depend. This pervasive threat leverages popular package registries such as npm and PyPI, alongside the developer-centric OpenVSX marketplace. The campaign cunningly exploits the inherent trust within open-source ecosystems, transforming routine development workflows into vectors for data exfiltration, credential harvesting, and persistent system access. According to analysts at CrowdStrike and other security firms, the operation has significantly scaled in both reach and sophistication since its inception.

The Glassworm campaign first emerged in October 2025 with the appearance of malicious Visual Studio Code and OpenVSX extensions on developer marketplaces. The initial wave of attacks reportedly infected approximately 35,800 developers. Since then, Glassworm’s footprint has steadily expanded to include Python repositories hosted on GitHub, npm packages within the React Native ecosystem, and tools associated with AI development.

The malware operates through multiple stages, beginning with a loader, progressing to credential theft, and ultimately deploying a persistent backdoor that allows attackers to maintain access long after the initial compromise. The targeting of developers is particularly alarming, as their workstations often contain sensitive assets such as cloud credentials, SSH keys, API tokens, and cryptocurrency wallets. A single compromised development machine can therefore expose an entire organization’s infrastructure and trigger cascading attacks across numerous interconnected repositories.

Attack Chain and Modus Operandi

The infection sequence begins subtly when a developer installs what appears to be a legitimate extension or package. The malware then activates in the background, harvesting secrets and transmitting stolen credentials to attacker-controlled servers, often before any signs of compromise are detected. CrowdStrike’s analysis, shared with Cyber Security News (CSN), highlights that Sonatype Security Research identified two hijacked React Native npm packages, collectively receiving over 30,000 downloads per week, both modified to deliver multi-stage malware linked to this campaign.

Glassworm delivers its payload through several channels. Malicious VS Code and Cursor extensions serve as primary entry points, with attackers even compromising legitimate publisher accounts to push malicious updates. This tactic allowed the threat actors to reach thousands of users without immediately raising suspicion from platform administrators.

Once established on a developer’s machine, Glassworm systematically steals GitHub tokens from various sources, including VS Code storage, the git credentials file, and local environment variables. These stolen tokens are then used to force-push malware into every repository associated with the victim’s account. Crucially, the injection preserves the original commit author and date, making the malicious changes appear as an integral part of the project’s history.

Concurrently, two widely utilized npm packages within the React Native ecosystem, which together garnered over 30,000 weekly downloads, were found to have been hijacked. These packages were modified to execute a malicious install script. This script notably included a check for Russian locale settings, skipping execution if detected—a common evasion tactic employed by some threat actors to avoid law enforcement attention in specific regions.

The malware ingeniously uses the Solana blockchain as its command-and-control (C2) channel. Instead of relying on a traditional server that could be taken offline, Glassworm reads instructions from transaction memos appended to a specific Solana wallet. This method allows the attacker to update payload locations at any time by posting a new transaction, and these instructions, once recorded on-chain, cannot be deleted or censored.

Stealth Techniques and Stolen Data

Glassworm employs sophisticated stealth techniques to remain undetected. One notable method involves embedding invisible Unicode characters in source code. These characters render as blank whitespace in code editors and GitHub’s code review interface, effectively making the hidden malicious payload invisible to anyone performing a standard code review.

The multi-stage payload further complicates detection. The initial stage acts as a loader, followed by a second stage that steals credentials and cryptocurrency wallet data. The third stage deploys a persistent backdoor utilizing WebSockets. Additionally, a malicious Chrome extension is installed to capture browser session data. The final payload is encrypted with AES, and its decryption key is transmitted only via server response headers, making static analysis extremely difficult.

What You Should Do

• Audit Extensions and Packages: Regularly review and remove any unrecognized or suspicious VS Code extensions and development packages.
• Rotate Credentials: Immediately rotate all GitHub tokens, SSH keys, and cloud credentials on any system that may have been exposed.
• Enable Multi-Factor Authentication (MFA): Implement MFA across all developer platforms, including GitHub, npm, PyPI, and cloud providers, to prevent unauthorized access.
• Monitor Network Traffic: Watch for unusual outbound network connections to Solana RPC endpoints or unknown IP addresses, as such traffic is not typically part of a legitimate development pipeline.
• Implement Supply Chain Security: Utilize tools and practices that verify the integrity of open-source components and detect tampering in package registries.
• Educate Developers: Train developers on identifying suspicious packages, extensions, and phishing attempts that could lead to initial compromise.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.