GlassWorm Supply Chain Attack Uses Fake VS Code Themes to Deliver Hidden Malware

GlassWorm is turning developer tools into malware delivery channels, this time through extensions advertised as attractive VS Code themes. The investigated cluster spans Visual Studio Marketplace and Open VSX, showing how appearance changes can provide cover for code that runs on developer machines. The campaign first surfaced in October 2025 and has since expanded across development platforms. Earlier reporting on developer tools spreading GlassWorm describes credential theft and persistent access, risks that make compromised developer workstations valuable gateways into repositories, cloud environments, and other sensitive resources. Researchers from Socket.dev identified four Marketplace extensions and six Open VSX identities linked to the theme cluster. Socket.dev said in a report shared…