Topic starter
09/07/2026 12:36 pm
TL;DR: GlassWorm uses compromised Visual Studio Code extension supply chains to steal developer credentials, republish malicious extensions, and reach C2 through Solana blockchain memo fields, while Knostic says it published YARA signatures to detect the behaviour. This is a supply-chain identity problem, not just a malware problem: trust collapses when extension publishers, tokens, and review processes are all part of the attack path.
Editorial analysis by NHI Mgmt Group, based on content published by Knostic: “Detecting GlassWorm with YARA Rules”.
Key questions
Q: What breaks when a trusted VS Code extension publisher is compromised?
A: When a trusted publisher identity is compromised, the marketplace can distribute malicious code as if it were legitimate.
A: Compromised developer credentials turn one infected package or workflow into a distribution channel for more malware.
Q: What are the signs that an extension ecosystem is being abused for propagation?
A: Watch for suspicious republishing activity, new versions that appear after unusual credential use, hidden text or obfuscated logic in extension files, and outbound control traffic from developer tools.
Practitioner guidance
- Harden extension publishing permissions Separate extension publication rights from day-to-day developer credentials, and require explicit approval for tokens that can push to marketplaces or republish packages.
- Scan for hidden Unicode before release Add Unicode normalization and hidden-character checks to pre-publish review so invisible selectors and similar obfuscation cannot bypass code inspection.
- Inventory developer tokens with write access Map every npm, GitHub, OpenVSX, Git and SSH credential that can influence software distribution, then revoke any token that is no longer essential.
Bottom line: GlassWorm is a supply-chain worm, not a simple extension malware case, because it uses developer identities to spread through trusted marketplaces.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 12:42 pm
Extension marketplaces have become identity infrastructure: once a publishing token can place code into a trusted ecosystem, the marketplace is no longer a neutral distribution layer. The security question moves from package integrity alone to who can publish, under what lifecycle conditions, and with what revocation authority. That makes publisher identity and token governance central to software supply-chain risk.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams govern code distribution tokens and marketplace access?
A: Treat marketplace access as a privileged pathway, not a normal developer convenience. Limit who can publish, shorten token lifetime where possible, separate build from release duties, and require detection for anomalous republishing. If an account can push code to a trusted marketplace, it needs governance like any other privileged identity.
👉 Read our full editorial: GlassWorm shows how VS Code extensions can become worm carriers