What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Short answer: Socket reported on April 25, 2026 that it was tracking 73 cloned Open VSX extensions associated with GlassWorm activity, and that at least six had already activated. The other listings were assessed as likely sleeper extensions or otherwise suspicious—not as 73 confirmed infections. The inventory and activation status can change as publishers issue new versions or marketplaces remove listings.
What happened in the Open VSX marketplace
The listings copied popular extensions’ names, icons, descriptions and, in one example documented by Socket, README content. They used a different publisher and a distinct extension identifier, so the branding could look familiar while the package identity was not.
Socket also observed newly created GitHub publisher accounts with only one or two public repositories. An empty repository with an eight-character name appeared in the reported pattern. Those details are warning signs in this cluster, not a universal test: a new publisher is not automatically malicious, and an established account is not automatically safe.
Recommended Free Tools
How the timeline developed
| Date | Source | Reported development |
|---|---|---|
| April 25, 2026 | Socket Research Team | Initial report on cloned Open VSX listings linked to GlassWorm. The first versions did not necessarily contain obvious malware. |
| April 28, 2026 | SecurityWeek | Secondary coverage attributed the clone-cluster findings and activation assessment to Socket. |
| April 29, 2026 | Socket Research Team update | Socket described 23 new versions across 22 copycat extensions. Seventeen versions declared an extensionPack entry pointing to a previously identified malicious extension. |
Socket said the referenced malicious extension had been removed from Open VSX about 52 hours before the activation wave described in that update. That dated removal does not establish the current status of every related listing.
#1 Best Overall
What “sleeper extension” means
Socket defines the pattern this way: “A sleeper extension or package is a threat actor-controlled imposter that is published before it is weaponized.” The point is timing. An initial upload can appear ordinary, accumulate installs or trust, and then receive a normal marketplace update that changes what runs on a developer’s machine.
Socket documented several delivery routes:
- Bundled native binaries: the extension package can carry platform-specific executable components alongside its JavaScript.
- Remote VSIX retrieval: code can download another VSIX package from an external location instead of shipping the complete payload in the first visible version.
- Transitive extension relationships: an
extensionPackorextensionDependenciesdeclaration can pull in a separate component. - Obfuscated JavaScript and native modules: difficult-to-read code can conceal the loader or later-stage behavior.
As Socket put it, “The extension’s source code alone no longer reflects the behavior that ultimately runs.” A clean-looking first release therefore does not settle the safety question for later versions.
Why a clone can look trustworthy
Developers often choose extensions by scanning a familiar name, icon, short description or README. Copying those elements reduces the visual friction that would normally prompt a closer identity check. The decisive differences may be confined to the publisher namespace, unique identifier, version history or package manifest.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #2
The reported accounts and repository clues can add context, but they should support—not replace—identity verification. Confirm that the publisher and identifier match the project’s official documentation or another trusted announcement. Do not assume that a high download count, polished page or copied repository proves that the package came from the expected maintainer.
What the reported numbers do and do not prove
- The 73 figure describes suspicious cloned Open VSX listings tracked by Socket in its April 25 report; it is not a count of confirmed infected extensions.
- “At least six activated” was Socket’s count at that point in time. Socket warned that the number could change as further updates appeared.
- The April 29 update concerns later versions and relationships among copycat listings; it is a dated campaign development, not a current marketplace inventory.
- The sources do not quantify victims, credential theft, cryptocurrency losses or financial damage for this clone cluster.
Readers should therefore distinguish between a suspicious listing, a likely sleeper and an activated malicious version. Treating all three labels as interchangeable would overstate what the incident report established.
GlassWorm’s earlier history
SecurityWeek reported that GlassWorm first appeared in Open VSX in October 2025 in a dozen extensions that were likely downloaded thousands of times. That coverage described the use of Unicode variation selectors to make code harder to inspect visually and Solana blockchain infrastructure for command and control.
SecurityWeek also reported activity spreading to other open-source software ecosystems in November, followed by re-emergence in January and March 2026. Its account says the March activity compromised more than 150 repositories. Those historical figures describe earlier campaign activity; they are not measurements of the April Open VSX clone cluster.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteChecks developers can perform before installing or updating
1. Verify the publisher and identifier
Compare the Open VSX publisher namespace and full extension identifier with the project’s official site, source repository or release documentation. A matching name or icon is not enough when the publisher identity differs.
2. Review version history, not just the current description
Look for abrupt ownership changes, unusual release timing, newly added permissions, native files or dependencies, and versions that appeared after a warning or takedown. A benign first version does not clear subsequent updates.
Rank #4
3. Inspect declared relationships
Read the manifest for extensionPack and extensionDependencies. Follow each referenced extension and verify its publisher and identifier as carefully as the extension you intended to install.
4. Look for payloads outside the obvious JavaScript
Check the packaged contents for native binaries, install scripts, obfuscated loaders and code that retrieves VSIX files or other payloads from remote hosts. A source snapshot may omit behavior delivered at runtime.
5. Treat anomalies as a reason to pause
Unexpected publisher details, external downloads or executable components warrant deeper review by your security team before installation. These checks reduce blind spots but cannot guarantee that an extension is safe.
Best Value
Controls for security teams
Teams protecting developer workstations should evaluate extension behavior and dependency chains as well as the initial source files. A practical control set maps to the delivery methods Socket described:
| Control focus | What it should examine | Blind spot to avoid |
|---|---|---|
| Package inspection | Manifest, packaged files, native binaries and install-time scripts | Assuming JavaScript review covers native components |
| Dependency analysis | extensionPack, extensionDependencies and referenced publisher identities |
Scanning only the extension selected by the user |
| Network and runtime monitoring | Remote VSIX retrieval, unexpected hosts, child processes and file or credential access | Allowing a later payload to evade a one-time source review |
| Update monitoring | New versions, publisher changes and behavior changes after approval | Treating approval of the first version as permanent |
Maintain an inventory of installed extension identifiers and versions so an advisory can be matched to actual developer machines. For a suspected installation, preserve the version and relevant logs, consult current Open VSX and vendor advisories, and follow your organization’s incident-response process. Do not remove a named extension solely because it appeared on a historical list without checking its current status.
Are Open VSX extensions safe?
Open VSX is not made unsafe by this single campaign, but the incident demonstrates why marketplace presence is not a security verdict. Safety depends on the exact publisher, identifier, version, dependencies and runtime behavior. The April 2026 reports provide a time-bounded view of one GlassWorm-linked campaign, not a guarantee about every extension or its status today.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
