Source: socket.dev
Socket Threat Research uncovered a cluster of malicious VS Code theme extensions linked to the GlassWorm supply chain campaign, spanning both the Visual Studio Marketplace and Open VSX Registry. Two extensions, Aurora Nocturne Night Theme and Cosmic Nebula Themes, were confirmed malicious. Aurora Nocturne used a heavily obfuscated Windows downloader contacting fingercakes4sale[.]store to drop and execute a batch file, linked to XWorm RAT infrastructure. Cosmic Nebula Themes employed a staged AES-256-CBC encrypted loader that avoids Russian-language/timezone systems, uses a Solana blockchain dead-drop to dynamically resolve payload URLs, and executes remotely supplied JavaScript in memory. Additional cluster-linked extensions including Coca-Cola Christmas and Aurora Borealis Studio Theme retain executable code and remain high-risk despite not being currently weaponized. Git history, shared Russian-language developer comments, and source code fingerprints tie all extensions to a coordinated development lineage. The cluster accumulated over 8,000 VS Code Marketplace installs and tens of thousands of Open VSX downloads. A coordinated disruption of GlassWorm infrastructure was conducted by CrowdStrike, Google, and Shadowserver Foundation in May 2026, but the supply chain footholds remain.
