GlassWorm campaign uses 73 "sleeper" extensions in OpenVSX that are initially benign but turn malicious after updates. The extensions act as thin loaders using three methods: retrieving secondary VSIX packages from GitHub at runtime and installing via CLI commands, loading platform-specific compiled modules (.node files) containing core logic for fetching additional payloads, and using heavily obfuscated JavaScript that decodes at runtime to fetch and install malicious extensions with encrypted or fallback URLs. Extensions are clones of legitimate listings with similar icons, naming, and descriptions but different publisher names and unique identifiers. Originally used invisible Unicode characters to hide malicious code.