Cybersecurity — 2026-04-26
73 Sleeper Extensions Linked to GlassWorm Campaign Activate New Malware Wave in Developer Supply Chain
Socket researchers disclosed on April 26 that 73 impersonation extensions on the Open VSX marketplace connected to the GlassWorm supply chain campaign have been identified, with at least six already activated to deliver malware. The sleeper extensions were published by newly created GitHub accounts and can be weaponized through normal update paths to compromise developer environments.
Analysis
The 73-extension GlassWorm wave represents an incremental expansion of a supply-chain campaign that targets the development toolchain rather than deployed systems. Additional sleeper extensions willvery likely be discovered within 30 days: newly created GitHub accounts and the Open VSX marketplace's lower vetting threshold create an essentially unlimited publication surface, and the initial count reflects a partial sweep rather than exhaustive coverage. The six already-activated extensions demonstrate the campaign's operational model: publish dormant code, build an installation base through impersonation of legitimate tools, then weaponize via normal update channels. The developer-environment attack vector is particularly consequential because a compromised IDE extension can propagate malware into every application built in that environment, turning a single developer infection into a supply-chain amplifier.
The 73-extension GlassWorm wave represents an incremental expansion of a supply-chain campaign that targets the development toolchain rather than deployed systems. Additional sleeper extensions will