Dozens of Open VSX Extension Clones Linked to GlassWorm Malware

Security researchers have discovered more than 70 suspicious extensions in the Open VSX marketplace linked to the GlassWorm malware campaign, which targets developer credentials and cryptocurrency. These extensions are clones of popular legitimate extensions, published by newly created accounts as "sleepers" that appear harmless initially but can deliver malware through future updates. At least six of the cloned extensions have already been activated, continuing a pattern that began in October when GlassWorm first emerged using hidden code and blockchain-based command-and-control infrastructure.