GlassWorm Supply-Chain Attack Compromises 433 GitHub/npm/VSCode Repositories

Security researchers identified 433 compromised components across GitHub, npm, and Open VSX extensions in the GlassWorm campaign. Attackers used stolen GitHub tokens to force-push obfuscated payloads into legitimate Python repos using zero-width Unicode characters invisible in code review interfaces. C2 instructions are retrieved via Solana blockchain transaction memo fields, targeting crypto wallets, SSH keys, and developer credentials.