{
  "slug": "glassworm",
  "name": "GlassWorm",
  "aliases": [
    "Glass Worm"
  ],
  "status": "dormant",
  "firstSeen": "2025-10-01",
  "lastSeen": "2026-05-26",
  "lastReviewed": "2026-09-20T00:00:00Z",
  "summary": "Developer-tooling malware spread through extensions and package branches.",
  "description": "GlassWorm targeted IDE and developer ecosystems, growing from extension delivery into npm and PyPI branches before a coordinated takedown.",
  "actor": "GlassWorm operators",
  "platforms": [
    "openvsx",
    "vscode-marketplace",
    "npm",
    "pypi",
    "github"
  ],
  "ttps": [
    {
      "framework": "atr",
      "id": "supply-chain"
    }
  ],
  "timeline": [
    {
      "date": "2025-10-01",
      "branch": "extension",
      "id": "code-wakatime-activity-tracker",
      "note": "Source gives \"≥35,000 installs by October 2025\"; month only.",
      "source": "https://thehackernews.com/2026/05/glassworm-malware-takedown-disrupts.html",
      "approximate": true
    },
    {
      "date": "2026-05-26",
      "branch": "report",
      "id": "glassworm-takedown",
      "note": "At least 35,000 installs and 320 artifacts were reported before takedown.",
      "source": "https://thehackernews.com/2026/05/glassworm-malware-takedown-disrupts.html"
    }
  ],
  "iocs": [
    {
      "type": "extension",
      "value": "code-wakatime-activity-tracker",
      "firstSeen": "2025-01-01",
      "source": "https://thehackernews.com/2026/05/glassworm-malware-takedown-disrupts.html"
    }
  ],
  "exposedConfigurations": [
    {
      "label": "Open VSX or VS Code marketplace plugins are installed",
      "matcher": {
        "some": "plugins",
        "where": {
          "field": "marketplace",
          "op": "in",
          "value": [
            "open-vsx",
            "vscode-marketplace"
          ]
        }
      }
    }
  ],
  "advisories": [
    "ACVE-2026-0413"
  ],
  "incidents": [],
  "sources": [
    {
      "url": "https://thehackernews.com/2026/05/glassworm-malware-takedown-disrupts.html",
      "publisher": "The Hacker News",
      "date": "2026-05-26"
    },
    {
      "url": "https://www.crowdstrike.com/en-us/blog/inside-crowdstrike-takedown-of-a-developer-targeting-botnet/",
      "publisher": "CrowdStrike",
      "date": "2026-05-26"
    }
  ],
  "dormantAfterDays": 30
}