critical self propagating worm openvsxvscode

GlassWorm

First self-propagating worm using invisible-Unicode code; hit OpenVSX and the VS Code Marketplace, harvested NPM/GitHub/OpenVSX/Git credentials and 49 crypto wallets, and deployed the ZOMBI RAT.

Disclosed October 17, 2025

Blast radius ~35,800 installs

Status mixed

Overview

GlassWorm is the first self-propagating worm to spread through extension marketplaces using invisible-Unicode code. Disclosed October 2025, it compromised extensions on OpenVSX and the VS Code Marketplace, using a Solana-blockchain dead-drop for C2 and deploying the ZOMBI RAT (SOCKS proxy, HVNC, WebRTC).

Payload

Harvested NPM, GitHub, OpenVSX and Git credentials plus 49 cryptocurrency wallets. The malicious versions are listed under affected extensions; exact malicious versions are confirmed by Koi and the public tool-glassworm-detector IOC script.

Samples

132 verified samples (18 crx + 39 js extension artifacts, plus ZOMBI RAT binaries) are catalogued as sample: true IOC hashes and held in quarantine.

Affected extensions (14)

Name	Store	ID	Malicious version	Archived
codejoy-vscode-extension	openvsx	codejoy.codejoy-vscode-extension	1.8.3, 1.8.4	yes
vscode-theme-seti-folder	openvsx	l-igh-t.vscode-theme-seti-folder	1.2.3	yes
serenity-dsl-syntaxhighlight	openvsx	kleinesfilmroellchen.serenity-dsl-syntaxhighlight	0.3.2	yes
rust-doc-viewer	openvsx	JScearcy.rust-doc-viewer	4.2.1	yes
dark-theme-sm	openvsx	SIRILMP.dark-theme-sm	3.11.4	yes
git-worktree-menu	openvsx	CodeInKlingon.git-worktree-menu	1.0.9, 1.0.91	yes
better-nunjucks	openvsx	ginfuru.better-nunjucks	0.3.2	no
recoil	openvsx	ellacrity.recoil	0.7.4	yes
positron-plus-1-e	openvsx	grrrck.positron-plus-1-e	0.0.71	yes
color-picker-universal	openvsx	jeronimoekerdt.color-picker-universal	2.8.91	no
srcery-colors	openvsx	srcery-colors.srcery-colors	0.3.9	yes
shopify-liquid	openvsx	sissel.shopify-liquid	4.0.1	yes
forts-api-extention	openvsx	TretinV3.forts-api-extention	0.3.1	yes
cline-ai-agent	vscode	cline-ai-main.cline-ai-agent	3.1.3	no

Indicators of compromise (137)

solana_wallet	28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2		C2 dead-drop
ip	217.69.3.218		primary C2
ip	199.247.10.166		C2
ip	140.82.52.31		exfil /wall
ip	199.247.13.106		exfil /wall
sha256	00d7f42ce14bc4c20a5d8d79433a36b2a5ba251af63e7fab41cd23d8cd5fb138	sample
sha256	01c8f6c1ad9dd78c27dad09b1a3cdc9dce27dfbfa1e01f2b601c1808402aa019	sample
sha256	025216442642dddaff9d6c93cb659303bc4291ddc9d3177327c0e9c58dd2c9e1	sample
sha256	053620962047f50a91c6e8d1a6519eccc41fab51473f033086b4d816abe8bcb0	sample
sha256	05a3584d3b296f9007fa41911403c40d59cdd46bc5179f29b43fe226c18cca5a	sample
sha256	06fab21dc276e3ab9b5d0a1532398979fd377b080c86d74f2c53a04603a43b1d	sample
sha256	09bd42f47e101a0cfe5456e88b5f10b8a2426616631a4956a7454b6c17c8d2f7	sample
sha256	0b90ede080e5fca2dc60740262932634dea6127af825c671c1dc5f384e75fe84	sample
sha256	173e7420c9a9aa2ec9271c362a4c24b068e5bc8fceca5e036eb6abc88bd1ab0a	sample
sha256	1997409c429dcc0a21011ca52121a8bbaf2a39bacaad31f9cf7a160a89c361aa	sample
sha256	1d36b57e448b28a0e0d91279ef7a7849c6355d8fdb874b42a86ac9d9f90a25cf	sample
sha256	1e5dfb51162c91d03c80c5dec50a6a5fce5194b7ee170ba09ca5fe0075bd5515	sample
sha256	1e6487b7fbb9a0ff4c1d7032bfecd153fa6b9cc3c523243e8183588a98168267	sample
sha256	1ed7ca5301e96e3cef201311b76ba33f842fdb34e91041177865b6e07acb7b4d	sample
sha256	1f51780838c5ca56336645bfc6e2812f4a68b8abd6d02bf62bc308b62a583bb8	sample
sha256	21a634d93f53c611356089ce472b3dd0fd6de5037fb98a48c8d64ac8133292ab	sample
sha256	21dd863ff9bbd15da01c1218bf92bd65eeae04a41876e10c41733b58035414c4	sample
sha256	22636bbb9e1f26a4ce31fa185d4a4add37580888b6376922aa364a8032490dcb	sample
sha256	235dc9b79d455b87242482bedfc56f9def42c3976debbde6d3a4f1d998cedef0	sample
sha256	24269ae7a306178f21a7e0b4502358d1d0931eded86c3a9caa5ea8471ba34ce3	sample
sha256	2b2425893c83dc53fb87975a080efb361da8da37df21c157a3bb601738c608b8	sample
sha256	2ba01d4141fce7342a7f0cc330e6c08da83cfe5d4bfd1a79b69f20d2b1f4f7e5	sample
sha256	2f69bd40a343b14a0cdbd498ea4d673b69855bbfb77b655fdacf5327018e329a	sample
sha256	30a1cf488aa5ff72dc76d4a9d9409b5a148c4b3a061e742f52b48348450797fd	sample
sha256	35302b25381e53272a79b77f6600a1749ab8988faf2f74305da962413bc672b1	sample
sha256	3a79036ce04c504a193d85ddcc34a4ca5df583a64bfff81fc0b53b03d16de6e9	sample
sha256	3cc0a9e9f064486bf063e69be03ca65557d8182d2975185d44677b66814cdaa2	sample
sha256	3cfa7942b9863652c7ab42d0c389e1e6ae3ec51b70d3145bf05b34564da8f101	sample
sha256	3ee16b73ec84f6d1a448bdc6343a17d93bebe515f306ad3986729493443389be	sample
sha256	401c125517b1f845289bf0a7a33e5db0391034f631eab85dd65b76b7fec9a959	sample
sha256	415a4f39dd93c2ad5fd02023489352b974a9a917664240299ca4c35ca9a5a362	sample
sha256	41caca39e0605527f6124e18902b8719131b1e13531fa5b71da4020ea6b9e1a7	sample
sha256	43253a888417dfab034f781527e08fb58e929096cb4ef69456c3e13550cb4e9e	sample
sha256	442ae757a5d2aa698693fd95862680ac2ed197909e50da5c03c22c025ae593ce	sample
sha256	4430b9f555dfca96555698de32fecd0fd1e099c3f4690c13fb169f4c8972ce9d	sample
sha256	49cd8c05959153106d9a7472cd1042310ad7825eb1260ec155ff906315012634	sample
sha256	4a2f0f1893527e4c419f36c2e4f95a61617074200bb67218fb96ae74125e433b	sample
sha256	4a30256a360aa2dc3c388d39bddb44f0efb0f9e25da2675b03b288b621b0052c	sample
sha256	4c8221b118341c55830cb3b72cff793cd633457d70473a20a1e68c8e5b65222a	sample
sha256	4e339dcdc3e3a8bf5271f7f76a9c4f064d3e34cbb51f8770ff4cce910fbcbce5	sample
sha256	4ebfe8f66ca7e9751060b3301b5e8838d6017593cdae748541de83bfa28183bd	sample
sha256	4f1ade751ddd15affe423ca9f138c7520190137157617d4e89e5fe6dee26c635	sample
sha256	50a891fe72f61b91bca13326f7b334437054fe8e6d6620665c3d47b0118c7792	sample
sha256	53cd02e362b1e50a2dc7becbbba17ab0c196c9a7dd378d6af516570acc046a8e	sample
sha256	5580ad5be7d8ca45533b604d9b4edcfed791d4fb0be8140b0d7fc4cba17c42ac	sample
sha256	5629be21869a83e9b9da86ab16a2d9cebd0aed2c04a9efe2ac044dfe0d5db6b9	sample
sha256	566bb30ad42762b4584c55267158ea901602fc149fb2e0911107e49432de1249	sample
sha256	5753dcccb7f40375067a4a788a78a0846e1ac43d78ba314739594a2145b77fb8	sample
sha256	59221aa9623d86c930357dba7e3f54138c7ccbd0daa9c483d766cd8ce1b6ad26	sample
sha256	5b9040d570452dd8064d539475737c4a2fa6f51b665a9bdfdedace0bb04934a0	sample
sha256	5fbc950e95cd5f466eecaec6e7d388746c714c0464502343d6e3e04c2d6cb917	sample
sha256	616171dbe37f615cde522a11ef4d5f631fbf15f70e10d326f83eca954e5552c6	sample
sha256	664408e2c14cbf4ad1eeea0d7bb65593e612527bacc7b814b00b2f0a445a6cba	sample
sha256	68e5fb92a7d7d182306a025010c77ae2cd89c39031cced13f9686a9f34671041	sample
sha256	69017b82c6d80c3e0dd87898cdd533f104dc2b06c9fcaadfe2943b9c82228924	sample
sha256	69b198e4c33868550e34da5af74162a938166b47c1f25d5a3033aac57a8a42bc	sample
sha256	6aab340b1e06e2d2f3f591183a6669b70c5a6e5934c40f33f804f9b89b2b5452	sample
sha256	6ccbe0765ecb9f4cfffc6cd7176ecb989cd7b4b371e4924563f708d44d935869	sample
sha256	6fbb15997087eeb37320503a99f42d4b41a0fcab92f2b34a833134821642d161	sample
sha256	71ffa9aa7378269d973e975b25c75081fc2172cf2a8f8d7312abe7f801c38f2f	sample
sha256	791b1cafbe292dd99cac33879701b0c76c0bdec8ef67f9c67448c6911b6dbdda	sample
sha256	7c98456c895f4113a53cbff902908e2893b263c0ffa1785dc3d021b3aecf9f5f	sample
sha256	7d4f9aaa72db209626824ad3c8a79b0c3a7300412dd604c1b372abe773000c24	sample
sha256	7fb54d95cb1738deb0d16de8b32547e76dd643e1e4762327a3554e4c4ce9d431	sample
sha256	81e7e8d207b4d758b3fcd164d3b45a9c8bc2bf1e7cb68b1fa7b8198b7fcc76ea	sample
sha256	82e1b88eed1fb8988bcb56488b941e3478cf7bf3d5a9c3a61e115735999f8876	sample
sha256	868938755dbacc4480a5395f12ae9c8467d735cd06bc69b608c84ea5becd40cf	sample
sha256	88a450a634f7393f6053d42df1575afbf82b3e8c7bb7f62dfc9aadcb7b93c94f	sample
sha256	8af226c0aa71fefe5228e881f4b5c5d90a8b41c290b96f44f56990d8dc3fac1c	sample
sha256	8e2c3244d3bf412d5be85525d65226aa24fc430b1908864805d2f2e00be28fda	sample
sha256	9531d9ddd44f9b7834e54994ee0c9332f76f324f17e1f02056afc0a8c5628408	sample
sha256	9a3eeeeac57f58a79659ebf0782fe2abd6b646e8960fcb5e99fb905db5728559	sample
sha256	9b6531cd6e4acf0546fa6df72b74874523e65338ff2605c748c70f0569771a2b	sample
sha256	a25a3e108f62a10caa2b736123ca7350e9dbc1b888c44e909cbd6866205ca671	sample
sha256	a6420bf24c4de18476fafc2ecceeb83d3929344ca8ab5e5d34a9cfbbff016fa6	sample
sha256	a8aa971911908daa82dbac12943d1aa615f05136da28f47fc9e9fa762f03a236	sample
sha256	a8e26db74a9f847a8adbd023b98ea5924cb801c756bb0ab12714a1878eae7d9f	sample
sha256	a9c9af685d1144dbc81bebf40dbb0e5bf66688bf034ac8b0f9d2094b9afee41a	sample
sha256	aaf746d532ae6491e1ff31a1219ef2ebf5fd7de15b7f3ba709d9b5d0577f15b2	sample
sha256	adcd965a58ae039c34220f475fff6a53bd911c58ae9847aee760c04edd96d6e2	sample
sha256	add1cdaad7cba96071b169b555b2225860500c75d506fe7841656d8e4a5242ff	sample
sha256	ae456e90f894c0f039b58550240f71f1b243f5428402178f47d586406ebe9622	sample
sha256	b40fd232b465f00947113abfa284fb7dee0565f2fa5c3be2e347eb0de04c37f9	sample
sha256	b6dc5c1e1ddef7a543288e080b40a8c6acc143fe258c7889ce68d57ab153dee5	sample
sha256	b8afd3a380348bbd5432a6955330377b682a1f35335600501f3985fb3e3719b1	sample
sha256	b9406f9490c3faddc109eca46d2781925a3b9bc9e04488e48013d29fd0e1f1b8	sample
sha256	baeeb416eb46e13927c462dd392bc03f7734a70bcb7a24c873e1b3c42f04304f	sample
sha256	bb68992f6aa2d3f316322e88d9e71491a38e95fd3a27f48084c66b9c210bd17d	sample
sha256	bbcbe7fa01c597f3d37ef3a0c9077b6def10c7986ece115a65852592e9c8fbd3	sample
sha256	bc879518748f2747b4898b4e6938546975692363573f668dcf4661bab62cb635	sample
sha256	c32379e4567a926aa0d35d8123718e2ebeb15544a83a5b1da0269db5829d5ece	sample
sha256	c4614cd001884175ff092c2e2c2c189e78d49e85551e507cdc5cfb16b631f2fc	sample
sha256	c5e549d5d09c15223665a3fff078aaefbc890052c0b819ae6bb768f4300ac692	sample
sha256	c7a8183afc77f89bb00f8b9a57bb3944cb42021a883c67a59b80236398682dcb	sample
sha256	c7ab7cd59325272f114aa5f77c1cd0efe0e7d93a5bd7414c0faff9d7c9f2e38b	sample
sha256	c855eed359270276ccec08902cfd360bbd5ef0dd928ea4626fc69a981fa10a32	sample
sha256	c9444fffb98de28ee1582aac098c2677ecd2b4bb1c6578fbb782c1c338889007	sample
sha256	c97a93c76f55bbb71fa255ed988a9671731dc28ec00103dd2d7b0d02a4dfa8f0	sample
sha256	cdae573ab468b24c28a42d6078daf2da1a4b4c5657a4146ad966e2fe8340cb49	sample
sha256	ce4a84006f9d106e9b32bce24ea9088475e4bf7774affcaeb1421d71a112946f	sample
sha256	d02db967b9ccf083bb79b10216dd5bd150c6dddcad477b95b3fe5dde0ed7e009	sample
sha256	d1aefa4ea3a380c61f74a99b29e02b2ee2ba6d66c1b004fb38faeb647cc87e21	sample
sha256	d371b9bc3af2d0314706a9f395b87661e572d5d4ccbf95a53465374818e5f7e6	sample
sha256	d44b59b50b243fb7413098e9548e5edae2d1bf0439dff8d72e7bbef49d6b522b	sample
sha256	d5cd5301d9458fbc3c41a9fb0371a3857614cb398d1c1090c3bf13a13da3caa9	sample
sha256	d72c1c75958ad7c68ef2fb2480fa9ebe185e457f3b62047b31565857fa06a51a	sample
sha256	d7a5c5145afe6c20fc4d538f379496dad11e841be83ad592fbc32ba2a48e2b4c	sample
sha256	d7b8bfb0c0e04329b9d226d42cbb5b5dec2a8409596a8abf99a139ddae17c8fb	sample
sha256	db88feb7d333429e19f482ab28d95a8bfcb2aa1d9949f549f6da58feb3d033e5	sample
sha256	dd3e3da55a9be4e601f7992b5c4a82f816707e61434a88d04642544f5713c273	sample
sha256	de4362531e4f5e49b816833feb25ae718f758f229b823a8776248df7049fcdd1	sample
sha256	de81eacd045a88598f16680ce01bf99837b1d8170c7fc38a18747ef10e930776	sample
sha256	df3c034de5ecd4c24798bb8f83e20628eccfc6819ed1611ac6f7576bbc0d3bbf	sample
sha256	dffa23dfd1efeec8be847c20e67f7ac37d487e1a31abfed6ffe407bc412dcbed	sample
sha256	e14ffcf75bc0e24a96c1f075d957513396290b22cd68c26a16c75f6dcfc816bf	sample
sha256	e37357e575a8c416e3e7770f2eeece99254833144d3a4ca1cb135fe816da702a	sample
sha256	e3bc168ec734aec9196a0e42cf787888e8842a5ffd4b7271caa0b47a14048771	sample
sha256	e56dfb687fc9f6a16be92701c162a21fde4d8647e583e64f953435e2fc90d67f	sample
sha256	e90163b8ffbe74ef786301ab54e25a07a67d91988efdeec3f6507ddc64e51d0a	sample
sha256	e97e50b6e104fdbcd2dc33cfe3cbb50df9a1fe28326af6d507260b4cb741799f	sample
sha256	eb07431d9f5cd47b5e54bc4759ed5650621bc1086e919686f891fe9ee415de28	sample
sha256	ee3e4dd5c1e073b8805f4107ccc7bc7e6e3c209fe13ea04ff3f2173c8dbe74a6	sample
sha256	f18f150716ee4d2e8ad3cba9fd2d6c49cd99acc62103cbfcedc12a83dc5cf3f6	sample
sha256	f1a64ff07d4805e09e5784b8aad07d82c0419e8db2d7819e0e6e136bd1ca3627	sample
sha256	f57c6001a33ce32d91d22cad1ed406ba1601bc6856e82d7ac0676b10935201e6	sample
sha256	f718df96f7770e29619de136e880bc3dda341ab0fe088de81546ef6396855362	sample
sha256	f805deff11b70100c3ee772394aaa404edfb791a89ef07f690f72a69fd542e5f	sample
sha256	f89ce54fae3ab66ed40da0b0a90a0aeaa5ec70921cf630012f500ad9a4745bc6	sample
sha256	f92792db983f1e82d1dc3a0eaceb28446d88ea1d692c83c0bdde23ef56c1b901	sample
sha256	fd4f7c8c21a658508e1d595e5ecf4536ac3cf851f1f0a624b8b1ff897a103847	sample
sha256	fdba5be3da2467e642bd8710f971e6b266b30ac15f5f413982fd719d7e0bffd9	sample
sha256	fe06f0d6324dca4359f87e4fea76c4068e6bf7265962407f2c67828e128097f6	sample

Sources

https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace