THREATNOIR
Subscribe
Back to advisories

Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX

GlassWorm threat actors have distributed malicious VS Code extensions across Visual Studio Marketplace and Open VSX that masquerade as legitimate themes. These extensions contain malware loaders capable of executing arbitrary JavaScript and establishing C2 communications using novel techniques like Solana transaction memos. Thousands of developers have installed these extensions, creating widespread supply chain risk.

CRITICALAdvisoryOct 04, 2026
Action required
Immediately audit your organization for installations of 'Coca-Cola Christmas', 'Aurora Borealis Studio Theme', and 'Cosmic Nebula Themes' across all developer workstations. Revoke any compromised credentials, isolate affected machines, and review VS Code extension activity logs for suspicious JavaScript execution or network connections to unfamiliar domains.
Affected products
VS Code MarketplaceOpen VSXVisual Studio CodeCoca-Cola ChristmasAurora Borealis Studio Theme
Linked articles
Source links