ACVE-2026-0413 · Malicious component · HIGH

Unverified · secondary sources only

WHAT HAPPENED

On activation the extension downloads a second-stage VSIX and force-installs it into every IDE on the machine.

THE SETUP — is yours like this?

Harness: Any IDE with the specstudio/code-wakatime-activity-tracker extension installed (VS Code, VS Code Insiders, Cursor, Windsurf, VSCodium, Positron), www.aikido.dev
Model: any model, www.aikido.dev
Goal: not stated (unconfirmed)
Tools: Zig-compiled native addons win.node and mac.node; the autoimport-2.7.9.vsix downloaded from a GitHub release; the floktokbok.autoimport second-stage extension installed into each IDE, www.aikido.dev
Approval: The dropper runs on extension activation and installs the second stage using each IDE's own command-line install path, with no prompt, www.aikido.dev

WHAT TO CHANGE

Remove the extension and the floktokbok.autoimport second stage, then rotate secrets.

Remove AgentPlugin:specstudio/code-wakatime-activity-tracker@openvsx. Malicious look-alike of the WakaTime extension (Aikido). Owner: operator

HARM, REACH AND RECOVERY

Harm: persistence

SOURCES

REPORT

Technical details

The GlassWorm dropper force-installs a malicious second-stage extension into every IDE on the machine when the Open VSX extension specstudio/code-wakatime-activity-tracker activates.

Model as recorded: any

Severity: HIGH
Status: Unverified
Kind: Malicious component
Modified: 2026-09-25
Aliases: No CVE assigned — No CVE, GHSA or OSV entry was found for this extension on 2026-09-21.
CVE boundary: supply-chain
Affected: VSCode:https://open-vsx.org: specstudio.code-wakatime-activity-tracker — all versions
Harness/product: specstudio.code-wakatime-activity-tracker
Classes: supply-chain; credential-theft; CWE-506
Taxonomy: ASI: ASI04; ATLAS: AML.T0011.001; ATLAS: AML.T0074
First reported: 2026-04-08 — Aikido Security
Input controlled by: package-publisher
Divergence: none
Goal as recorded: Any install or update of the package (goal not stated by the source)
Licence: CC-BY-4.0 advisories; MIT code

Reproducibility: partial (vulnerable components are not confirmed obtainable; trigger not published)

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

In the wild

exploited-itw · dfir, dfir

Description

What

Aikido (2026-04-08) found that this WakaTime look-alike loads Zig-compiled native addons (win.node, mac.node) that run outside the extension sandbox, download autoimport-2.7.9.vsix from a GitHub release and force-install it into VS Code, VS Code Insiders, Cursor, Windsurf, VSCodium and Positron. That second stage, listed as floktokbok.autoimport, skips Russian systems, uses a Solana-based C2, exfiltrates secrets and installs a RAT. CrowdStrike disrupted GlassWorm's C2 on 2026-05-26. Open VSX no longer serves the extension (checked 2026-09-21).

Detection

acve lock does not inventory Open VSX extensions, so the matcher cannot fire today: look for either extension id in each IDE's extension list.

Fix

Remove both extensions, treat the machine as compromised and rotate its secrets.

Configuration

The rule ACVE's audit tool uses to recognise this configuration. The tool is not public yet.

some plugins where
  and
    name eq "specstudio/code-wakatime-activity-tracker"
    marketplace eq "openvsx"

Report a problem JSON