GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools

The GlassWorm supply chain campaign has returned with 24 malicious extensions targeting developers through Microsoft Visual Studio Marketplace and Open VSX. The extensions impersonate popular developer tools and frameworks including Flutter, React, Tailwind, Vim, and Vue. This campaign was first documented in October 2025 and utilizes the Solana blockchain for command-and-control communications. The attack specifically targets the development ecosystem by infiltrating trusted extension marketplaces with fraudulent versions of legitimate tools.