Socket Uncovers 10 GlassWorm Loaders in VS Code Themes

Cybersecurity15 days ago

Malicious software is entering code editors via deceptive extensions hosted on the Visual Studio Marketplace and Open VSX. Researchers at Socket identified a cluster of 10 malicious themes linked to the GlassWorm threat actor, consisting of 4 plugins on Microsoft's marketplace and 6 on Open VSX, including one disguised as a Coca-Cola Christmas theme. These extensions function as loaders that allow the delivery and execution of additional malicious payloads once a user installs them.

The discovery highlights a vulnerability in the developer supply chain where users often install cosmetic enhancements without verifying the publisher. Because these threats are embedded in themes—which are typically perceived as low-risk visual changes—they can bypass developer scrutiny. Socket recommends that all users audit their installed extensions to identify and remove any unauthorized loaders.

Mapped to your portfolio

Possible scenarios

45%Rapid Containment-0.0%
25%Broader Extension Campaign-0.2%
20%State Actor Attribution-0.1%

Each figure is the modeled move of the S&P 500 if the outcome occurs. For information only. Not investment advice.

Looking for more context or analysis?

Tilt chat provides reliable, tailored insights, alerts, and automations.

Socket Uncovers 10 GlassWorm Loaders in VS Code Themes

In this story

Socket GlassWorm Microsoft Open VSX

Portfolio

SPY
State Street SPDR S&P 500 ETF Trust
100%

Portfolio

SPY
State Street SPDR S&P 500 ETF Trust
100%

Mapped to your portfolio

Possible scenarios

45%Rapid Containment-0.0%
25%Broader Extension Campaign-0.2%
20%State Actor Attribution-0.1%

Each figure is the modeled move of the S&P 500 if the outcome occurs. For information only. Not investment advice.