{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0413",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "GlassWorm extensions target developer credentials across IDEs",
  "details": "## What\n\nGlassWorm distributed malicious VS Code and Open VSX extensions, including code-wakatime-activity-tracker, and later related npm and PyPI artifacts. The campaign targeted npm, GitHub, and wallet credentials and used Node RAT and SOCKS infrastructure. Public install figures are exposure measures, not a count of compromised developers.\n\n## Which configuration is exposed\n\nThe exposed configuration enables the named extension in VS Code, Cursor, Windsurf, or VSCodium. These IDEs give extension code a developer workstation context, so the supply-chain boundary exists even when the model and agent approval settings are restrictive.\n\n## How ACVE detects it\n\nACVE matches the extension name and open-vsx marketplace. It cannot inspect extension contents or infer whether the user opened a project while the malicious code was active. A different extension identifier or marketplace requires separate review.\n\n## Fix\n\nRemove the extension and related artifacts, rotate npm, GitHub, cloud, SSH, and wallet credentials, and inspect for SOCKS or RAT persistence. Restrict extension installation to reviewed publishers and retain package hashes for future audits.\n\n## Grounding needed\n\nThe CrowdStrike and news sources should be checked for the extension list, campaign dates, and takedown claims. The install figure is preserved as a range because it is not a victim count.\n\nThis record is limited to the condition named in the public source: GlassWorm extensions target developer credentials across IDEs. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentPlugin",
        "name": "code-wakatime-activity-tracker@open-vsx"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "supply-chain",
        "credential-theft"
      ],
      "cwe": [
        "CWE-522"
      ],
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://thehackernews.com/2026/05/glassworm-malware-takedown-disrupts.html",
            "type": "news"
          },
          {
            "url": "https://www.crowdstrike.com/en-us/blog/inside-crowdstrike-takedown-of-a-developer-targeting-botnet/",
            "type": "vendor"
          }
        ],
        "kev": {
          "listed": false
        },
        "last_seen": "2026-05-26",
        "victims": {
          "range": "at least 35,000 installs; successful victim count unverifiable",
          "sectors": [
            "software"
          ],
          "evidence": "The sources describe a developer-targeting extension campaign and its takedown."
        },
        "attribution": "GlassWorm operators"
      },
      "cveBoundary": "supply-chain",
      "matcher": {
        "some": "plugins",
        "where": {
          "all": [
            {
              "field": "name",
              "op": "eq",
              "value": "code-wakatime-activity-tracker"
            },
            {
              "field": "marketplace",
              "op": "eq",
              "value": "open-vsx"
            }
          ]
        }
      },
      "fix": {
        "summary": "Remove GlassWorm extensions and rotate developer credentials.",
        "actions": [
          {
            "type": "remove",
            "target": "AgentPlugin:code-wakatime-activity-tracker@open-vsx"
          },
          {
            "type": "reconfigure",
            "target": "plugins",
            "why": "Allow only reviewed extension publishers."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:26:27Z",
          "sources": [
            {
              "url": "https://thehackernews.com/2026/05/glassworm-malware-takedown-disrupts.html",
              "status": 200,
              "contentType": "text/html; charset=UTF-8",
              "sha256": "sha256:dfdbb54f87b6d9c47dc2f398789db38cef75e2c6e71a888f67d038c1a1a88cf2",
              "type": "news"
            },
            {
              "url": "https://www.crowdstrike.com/en-us/blog/inside-crowdstrike-takedown-of-a-developer-targeting-botnet/",
              "status": 200,
              "contentType": "text/html;charset=utf-8",
              "sha256": "sha256:169f5e4b0544b82bc1bb977774a7936c38bdca95719e30d44ede6c9f2fea6f57",
              "type": "vendor"
            }
          ],
          "kev": {
            "listed": false
          }
        }
      }
    }
  }
}