Supply chain attack targeting Open VSX Registry where threat actors compromised legitimate developer credentials to push malicious updates. The attack involved compromised publishing credentials through either leaked token or unauthorized access. Malicious extensions delivered GlassWorm malware loader that uses runtime decryption, EtherHiding technique to fetch C2 endpoints, and targets macOS systems. The malware profiles infected machines and avoids Russian locales. It harvests browser data, cryptocurrency wallets, iCloud Keychain, developer credentials, and uses Solana memos as dynamic dead drop for infrastructure rotation.