Reposted by Jan
Socket researchers found a GlassWorm-linked VS Code theme cluster: 4 extensions on VS Code Marketplace and 6 on Open VSX. Related themes have thousands of installs. The malware fetches and executes payloads using encrypted loaders and a Solana dead drop.
socket.dev/blog/glasswo...
socket.dev
Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX
Socket uncovered two malicious VS Code themes in a GlassWorm-linked cluster with thousands of installs across VS Code Marketplace and Open VSX.