Reported by 2 outlets
GlassWorm Supply Chain Attack Hides Malware Inside VS Code Color Themes
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.50 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
GlassWorm-linked actors abused VS Code color themes on the Visual Studio Marketplace and Open VSX Registry to distribute malicious loaders. The themes contained executable JavaScript that should not be present in pure color packages, turning an editor customization into an initial-access vector. Two extensions carried the malicious payload. This is a supply chain attack through a trusted developer tool channel.
The story matters because VS Code themes are widely installed with minimal scrutiny; users expect them to be passive. When theme packages include executable code, the marketplace review process has clearly failed. Security teams should audit installed theme extensions for unexpected JavaScript and treat marketplace extensions as potential supply chain risks.
Watch for further GlassWorm-linked theme removals and any correlation with downstream loader deployments. No CVE is assigned, but the mechanism is reproducible: any theme or extension category that permits executable content could be reused.
Timeline
-
original reporting
GlassWorm Supply Chain Attack Hides Malware Inside VS Code Color Themes
gbhackers.com · 8d ago · October 5th, 2026
A GlassWorm-linked software supply chain campaign has abused seemingly harmless Visual Studio Code color themes to distribute malicious loaders across the Visual Studio Marketplace and Open VSX Registry. The activity demonstrates how extensions designed only to change editor colors can become high-impact initial-access vectors when they include unnecessary executable JavaScript. Both extensions presented themselves as […] The post GlassWorm Supply Chain Attack Hides Malware Inside VS Code Color Themes appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from securityonline.info
Socket links GlassWorm VS Code themes to malicious VS Code extensions with 8,000+ installs, including a Coca-Cola theme. See how to check yo
securityonline.info · 9d ago · October 5th, 2026
Socket links GlassWorm VS Code themes to malicious VS Code extensions with 8,000+ installs, including a Coca-Cola theme. See how to check yo
via Mastodon https://securityonline.info/glassworm-vscode-themes/?utm_source=mastodon&utm_medium=jetpack_social