Article
Trojanized Claude Code Extension: A Response Playbook for Malicious Extensions
A modified Claude Code 2.1.313 build in Cursor's marketplace planted an SSH backdoor. Steps to find it, clean up and block the next malicious…
Read more
Malware profile
GlassWorm Malware: From VS Code Extensions to the OVHcloud CLI Swap
GlassWorm is a worm that targets developer tools.
In short
GlassWorm is a worm that targets developer tools. MITRE says it compromises repository credentials and adds malicious payloads to those accounts. It was first reported in October 2025 in VS Code extensions. In October 2026 StepSecurity tied its loader to a swapped release of the OVHcloud command line tool.
- Names1names in public reportsGlassWorm
- Techniques15ATT&CK techniques listedInitial Access · Stealth · Execution
- Infection Steps5in the delivery chainInfect a developer laptop · Test the loader
In one minute
- What it is
- A worm and credential stealer that spreads through developer tools: VS Code and Open VSX extensions, GitHub repositories and, in October 2026, a swapped release of the OVHcloud CLI.
- What it does
- Steals tokens, browser and wallet data and developer credentials, then uses stolen publishing access to reach more projects. It reads its next server address from a Solana transaction memo.
- Who uses it
- No group is named. MITRE lists none for GlassWorm, and the vendor reports we read name no operator.
- How it gets in
- A developer installs a poisoned extension or runs a tampered tool. In the OVHcloud case, an extension on a personal laptop in October 2025 led to stolen release keys.
- What to do first
- Treat any host that ran a swapped OVHcloud CLI build as compromised, rotate every credential it could read from a clean machine, and pin SHA-256 hashes of downloaded tools.
What it does
MITRE lists several variants: Rust binaries, encrypted JavaScript and one that hides code in invisible Unicode characters. The loader checks the system language and time zone and stops on Russian systems. It then reads its next server address from a Solana blockchain transaction memo. If that fails, it falls back to Google Calendar entries. It takes browser data, wallet data and developer tokens. This is much like the Shai-Hulud worm and Mini Shai-Hulud which also spread through package registries.
The newest route is a swapped release. On 19 October 2026 an attacker used a compromised OVHcloud developer account on GitHub to replace release files of the OVHcloud command line tool, an example of compromising a software supply chain. StepSecurity found a GlassWorm loader in repositories tied to that account. The OVHcloud advisory describes the stealer inside the files. In its root cause section it says a Solana wallet “is known as belonging to the Glassworm threat actor”.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| GlassWorm | MITRE ATT&CK software S9010 and the vendor reports[1, 2, 4, 5, 6, 7] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Initial Access
Stealth
Obfuscated Files or Information: Invisible Unicode T1027.018
It hides code in invisible Private Use Area characters, so the code does not show in editors.[1, 5]
Obfuscated Files or Information: Encrypted/Encoded File T1027.013
It wraps its JavaScript in AES-256-CBC encryption and encodes server details in Base64.[1]
Masquerading T1036
It poses as legitimate VS Code extensions and as GitHub projects.[1]
Execution Guardrails T1480
It avoids Russian systems by checking language and time zone.[1, 2, 6]
Execution
Command and Control
Collection
Data from Information Repositories: Code Repositories T1213.003
Data from Local System T1005
It collects desktop wallet data and documents from the Desktop, Documents and Downloads folders.[1]
Data Staged: Local Data Staging T1074.001
It stages collected data in a temporary working directory before upload.[1, 6]
Credential Access
Persistence
How it spreads
Veracode, reporting the October 2025 discovery by Koi Security, says GlassWorm harvests npm, GitHub and OpenVSX credentials and uses them to compromise more packages and extensions. Aikido says that on 31 October 2025 it saw the attackers move to GitHub repositories, with project-specific commits that may have been AI-generated. Socket says four Open VSX extensions were poisoned on 30 January 2026, which Open VSX said was consistent with a leaked token or other unauthorized access.
In the OVHcloud case, StepSecurity cites OVHcloud's postmortem: a developer installed a malicious VS Code extension on a personal laptop in October 2025, and later release uploads used stolen keys.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Infect a developer laptop
On 20 October 2025 a developer installed a malicious VS Code extension on a personal MacBook, which installed a persistent NodeJS service.[2]
Test the loader
On 5 and 6 March 2026 four personal repositories of the attacker's GitHub account were force-pushed with hidden loader files.[2]
Stay quiet in a real account
From May to September 2026 the same account landed ordinary pull requests in an OVHcloud documentation repository.[2]
Swap the release files
On 19 October 2026 the attacker uploaded locally built binaries over five existing releases (v0.11.0 to v0.15.0) and, for v0.13.0 to v0.15.0, replaced checksums.txt last.[2, 3]
Steal and send
When run, the binary collected credentials and staged them in a temp folder, then sent an archive out as Solana-style JSON. In StepSecurity's replay this took four seconds.[2, 3]
Timeline
- October 2025
- 20 October 2025
Backdoor on a developer laptop
StepSecurity says an OVHcloud developer installed a malicious VS Code extension on a personal MacBook.[2]
- 31 October 2025
Move to GitHub repositories
Aikido says it found on 31 October that the attackers had shifted focus to GitHub repositories.[5]
- 22 November 2025
- 30 January 2026
Four Open VSX extensions poisoned
Socket says malicious versions of four oorzc extensions with over 22,000 downloads embedded the loader.[6]
- 5 and 6 March 2026
Loaders pushed to personal repos
StepSecurity says four repositories of the later OVHcloud attacker account were force-pushed with hidden loaders.[2]
- 26 May 2026
Takedown
StepSecurity says the Solana wallet is empty, which fits a CrowdStrike-coordinated takedown of all four GlassWorm C2 channels on 26 May 2026.[2]
- 19 October 2026
- 19 October 2026
Clean release
OVHcloud published v0.16.0, clean, immutable and attested, at 17:16 UTC.[2]
- 20 October 2026
OVHcloud advisory
OVHcloud published GHSA-862f-55f5-vmvw with the affected versions and the envchecker stealer.[3]
- 21 October 2026
Loader repositories rolled back
StepSecurity says the four loader repositories were force-pushed again, which removed the loaders from every branch.[2]
Detection and defense
Check for the swapped OVHcloud build
Do not run the file. OVHcloud says to compare its MD5 hash with the advisory list and to look for envchecker folders in the temp directory. StepSecurity says the malicious build prints undefined as its version; running it also runs the stealer, so compare the MD5 without running the file.[2, 3]
Questions
What is GlassWorm?
MITRE describes a worm that spreads through supply chain attacks by taking over repository credentials and planting malicious payloads in those accounts. It was first reported in October 2025 and targets macOS and Windows.
How did GlassWorm reach the OVHcloud CLI?
StepSecurity, citing OVHcloud's postmortem, says a developer installed a malicious VS Code extension in October 2025. Months later, release uploads used stolen keys to replace binaries on 19 October 2026.
How can I tell if I ran the swapped OVHcloud CLI?
Do not run the file to find out. OVHcloud says to compare its MD5 hash with the advisory list and to look for envchecker folders in the temp directory. Only installs between 12:47 and 14:21 UTC on 19 October 2026 are affected. StepSecurity says the malicious build prints undefined as its version, with the attacker's commit 5ead8ef, but running it also runs the stealer.
Why is GlassWorm hard to take down?
MITRE says it uses the Solana blockchain for command and control, and Veracode adds that Google Calendar serves as a backup. StepSecurity says the wallet is empty now, consistent with a takedown on 26 May 2026, but the operator could publish a new memo at any time.
Does GlassWorm still hide code in invisible characters?
Palo Alto Networks says the November 2025 wave replaced invisible Unicode with Rust binaries. StepSecurity says the loader recovered in 2026 again hides its code in invisible variation-selector characters.
In our research
Sources
- GlassWorm, Software S9010 MITRE ATT&CKSupports: Description, platforms, variants, Solana command channel and first report in October 2025.
- OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found StepSecuritySupports: The release swap, the GlassWorm loader stages, the timeline, the tell and the recovery steps.
- ovhcloud-cli security incident, October 19th, 2026 (GHSA-862f-55f5-vmvw) OVHcloud, GitHub AdvisorySupports: Affected versions and window, root cause, download count and the envchecker stealer.
- GlassWorm: The First Self-Propagating VS Code Extension Worm Veracode Threat ResearchSupports: The October 2025 report credited to Koi Security: installs, stolen tokens, Solana and Google Calendar.
- GitHub User Compromised with Invisible Malware Aikido SecuritySupports: The shift to GitHub repositories on 31 October 2025 and the hidden Unicode decoder.
- GlassWorm Loader Hits Open VSX via Developer Account Compromise SocketSupports: The 30 January 2026 extension compromise, loader stages, persistence and rotation order.
- Supply Chain Under Siege: GlassWorm's Native Rust Loaders Target VS Code Palo Alto NetworksSupports: The November 2025 return and the move from invisible Unicode to Rust loaders.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 59 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 100 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.