# GlassWorm Wave 1–3: Multi-Registry Supply Chain Campaign - **Artifact ID:** CHQ-EX-2026-009 - **Public record:** https://record.cybersecurityhq.com/exhibits/chq-ex-2026-009 - **Machine-record SHA-256:** `0f42e7e80625447d733deefca9c0a1f844e6b765f3a82d853ec37bc214abf7ad` ## Complete structured record ```json { "id": "CHQ-EX-2026-009", "title": "GlassWorm Wave 1–3: Multi-Registry Supply Chain Campaign", "subtitle": "Self-propagating credential theft cycle across GitHub, npm, Open VSX, and VS Code Marketplace compromising 433 components via transitive dependency abuse, invisible Unicode payloads, and blockchain command-and-control.", "classification_notice": [ "This document is published as a CHQ Exhibit. It records historical conditions, breach events, and industry practices as they existed during the periods described. This Exhibit records observed conditions, cascade mechanisms, and structural patterns as documented in public disclosures, security research publications, and vendor advisories during the stated period.", "This document does not address present conditions and carries no current applicability. No evaluation of past practices is intended or implied.", "CHQ Exhibits are not superseded by later artifacts unless explicitly invalidated for factual error." ], "metadata": { "artifact_class": "EXHIBIT", "temporal_scope": "OPERATIONAL (OCTOBER 2025 TO MARCH 2026)", "authority_level": "NON-JUDGMENTAL", "reliance_status": "CONTEXT_ONLY", "update_policy": "ERRATA_ONLY", "temporal_start": "2025-10-01", "temporal_end": "2026-03-31" }, "sections": [ { "heading": "I. Factual Record", "content": [ "Campaign Identity: GlassWorm. First observed October 2025 by Koi Security on Open VSX registry. Campaign expanded through three distinct operational phases across four open-source registries between October 2025 and March 2026.", "Scope: Approximately 200 Python repositories and 151 JavaScript/TypeScript repositories compromised on GitHub. At least 72 malicious extensions published to Open VSX registry. At least 10 npm packages compromised including react-native-international-phone-number (92,000 monthly downloads) and react-native-country-select (42,000 monthly downloads). Extensions published to Microsoft VS Code Marketplace. Estimated 9 million total extension installs across both marketplaces.", "Wave 1 (October 2025): Direct payload embedding. Seven compromised Open VSX extensions with approximately 36,000 downloads. Malicious loaders embedded directly in published extension code. Required attacker to create new publisher accounts for each wave.", "Wave 2 (January 30, 2026): Compromised publisher account. Four established extensions published by legitimate developer account (oorzc) received malicious updates: FTP/SFTP/SSH Sync Tool (~17,000 downloads), I18n Tools (~3,600), vscode mindmap (~3,200), scss to css (~1,300). Open VSX security team assessed incident as leaked token or unauthorized access. Malicious releases available until February 2, 2026.", "Wave 3 (March 2026): Transitive dependency abuse. 72 additional malicious extensions identified since January 31, 2026. Attacker publishes clean extensions passing marketplace review, then updates manifest extensionPack or extensionDependencies fields to declare dependency on separate malicious extensions. IDE automatically installs all declared dependencies including payload. Parent extension contains no malicious code.", "Payload Architecture: Heavily obfuscated JavaScript loader. Russian locale exclusion. Solana blockchain wallet queried at 5-second intervals for C2 URL via transaction memo fields. AES-256 encrypted stage-2 payload executed in memory via eval() or vm.Script. ZOMBI module: credential theft (npm tokens, GitHub tokens, Open VSX credentials, SSH keys, Git credentials), cryptocurrency wallet drain (49 wallet extensions), network reconnaissance, Chromium data theft, persistence via Windows Registry and scheduled tasks. WebRTC and BitTorrent DHT for distributed C2.", "Concealment: Invisible Unicode characters (Private Use Area, variation selectors U+FE00–U+FE0F and U+E0100–U+E01EF) encode payloads invisible to all standard code editors, terminals, diff viewers, and code review interfaces. LLM-generated cover commits provide contextually appropriate surrounding changes across 151+ distinct codebases. Force-pushed commits preserve original author, message, and date.", "Infrastructure: Solana wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC (primary) and 6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ. 50 transactions between November 27, 2025 and March 13, 2026 updating payload URLs. C2 IP addresses: 45.32.150.251, 45.32.151.157, 70.34.242.255. AES key: wDO6YyTm6DL0T0zJ0SXhUql5Mo0pdlSz, IV: c4b9a3773e9dced6015a670855fd32b.", "Self-Propagation: Stolen developer credentials used to force-push malicious commits to victim’s repositories, publish poisoned package versions under victim’s identity, and update victim’s extensions. Each infection produces credentials for next infection. Campaign scales through developer ecosystem without attacker operational scaling.", "Research Attribution: Socket (transitive dependency analysis), Aikido Security (GitHub repository compromise, LLM assessment), StepSecurity (Solana C2 analysis, timeline), Koi Security (initial discovery), Bitdefender (Windsurf IDE targeting), Cloud Security Alliance (structural analysis), Endor Labs (npm package analysis). Sources: The Hacker News, BleepingComputer, CSO Online." ] }, { "heading": "II. Failure Pattern", "content": [ "The GlassWorm campaign demonstrates that the developer supply chain is a propagation medium, not merely an attack surface. The trust relationships between registries — publisher accounts, dependency declarations, extension relationships, CI/CD workflow permissions — form a connected graph that an attacker can traverse using stolen credentials as the traversal mechanism.", "Each technique generation addressed a specific defensive response: Wave 1 defeated by marketplace takedowns led to Wave 2 account compromise; Wave 2 detection through malicious code review led to Wave 3 transitive dependency abuse where the parent package contains no malicious code. The campaign’s evolution demonstrates adaptive operational capability against registry-level defenses.", "The structural condition exposed is transitive trust inheritance across package ecosystems: trust delegated through dependency relationships crosses registry boundaries without attenuation. No registry independently verifies that a publishing action was authorized by the legitimate maintainer through a channel other than the credential itself.", "This incident is the primary evidentiary anchor for CHQ-P-2026-013. The self-propagating property — where credential theft is both the payload and the propagation mechanism — is the structural feature that distinguishes this from conventional supply chain compromise." ] }, { "heading": "III. Referenced By", "content": [ "CHQ-ED-2026-012 — Evidence Docket: Portable Developer Identity Cannot Contain Credential Compromise Across Registries.", "CHQ-P-2026-013 — Position: Portable Developer Identity Cannot Contain Credential Compromise Across Registries." ] } ], "closing_statement": "This Exhibit records historical conditions. It carries no present applicability. No evaluative judgment is made about any organization, vendor, security posture, or attribution conclusion.\n\nTemporal scope: October 2025 to March 2026. Exhibit issuance date is March 20, 2026.\n\nThis Exhibit records technical findings as reported by named security research organizations, not as established fact. Source attribution to Socket, Aikido Security, StepSecurity, Koi Security, Bitdefender, Cloud Security Alliance, and Endor Labs. Campaign designation “GlassWorm” as assigned by Socket. “ZOMBI” module designation as assigned by Fluid Attacks.", "hash_scope": "Full exhibit content body", "hash_generated": "2026-03-20" } ```