Topic starter
09/07/2026 12:37 pm
TL;DR: GlassWorm is a self-propagating malware campaign that spread through compromised developer accounts and the OpenVSX registry, targeting VS Code environments and AI coding assistants while stealing developer credentials, npm tokens, and crypto wallets, according to Knostic’s source analysis. The incident shows that IDEs have become privileged supply-chain targets, not just developer tools.
Editorial analysis by NHI Mgmt Group, based on content published by Knostic: “New Malware, New Problems for IDEs and AI Coding Agents”.
Key questions
Q: What fails when a compromised IDE extension is allowed into a developer environment?
A: A compromised extension can turn a trusted IDE into a distribution and harvesting point.
Q: Why do malicious IDE extensions create a supply chain risk for development teams?
A: Because the IDE sits between developers, source code, and build systems.
Q: What are the warning signs that an IDE extension is abusing trust?
A: Look for extensions that auto-activate, request broad OAuth scopes, proxy traffic through unusual domains, or run hidden background processes.
Practitioner guidance
- Audit extension publishing rights Identify every account that can publish or update IDE extensions in your environment and remove unnecessary rights.
- Scan developer workstations for exposed secrets Monitor IDE hosts for developer credentials, npm tokens, wallet artefacts, and other reusable secrets that a malicious extension could harvest.
- Separate AI coding tool trust from extension trust Review AI coding assistants, extensions, and marketplace access as distinct trust domains.
Bottom line: GlassWorm shows that a compromised IDE extension can become a propagation mechanism, not just a local malware event.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 12:44 pm
Developer tooling is now a privileged supply-chain surface, not a peripheral workstation layer. GlassWorm shows that extension ecosystems can become propagation infrastructure when publishing trust is abused. That means the security boundary has moved from the endpoint alone to the registry, the publisher account, and the local secrets exposed inside the IDE. Practitioners should treat extension trust as a governed access path, not a software convenience.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
A: Separate their permissions, review them as distinct trust domains, and limit what each can read or publish. If AI coding assistants inherit broad IDE access, the organisation is effectively expanding the blast radius of a single extension compromise.
👉 Read our full editorial: GlassWorm shows how compromised IDEs extend AI coding risk