GlassWorm Explained, How Malicious VS Code Extensions Weaponise Developer Trust

Developer tools run with a level of trust most apps never get. They sit close to your code, your secrets, your terminals, your cloud logins, and your repo tokens. That trust is exactly what GlassWorm goes after.
In October 2025, researchers reported a cluster of compromised and lookalike VS Code extensions circulating via OpenVSX, with tens of thousands of installs linked to the initial wave. The reported behaviour is nasty and practical: harvesting GitHub, git, and npm credentials, scanning for Crypto wallet extensions, and adding capabilities like proxying and remote-access-style…