GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools

The GlassWorm supply chain campaign has returned with 24 malicious extensions infiltrating Microsoft Visual Studio Marketplace and Open VSX. These extensions impersonate popular developer tools and frameworks including Flutter, React, Tailwind, Vim, and Vue. The campaign was first documented in October 2025 and utilizes the Solana blockchain for command-and-control communications. The malware targets developers by disguising itself as legitimate development tools to harvest npm credentials and potentially compromise development environments.