GlassWorm Malware - Major Attack Hits GitHub and npm Repos

What Happened

The GlassWorm malware has resurfaced, launching a significant supply-chain attack that has compromised over 400 code repositories across platforms like GitHub, npm, and VSCode/OpenVSX. This coordinated campaign, identified by researchers from Aikido, Socket, and Step Security, has revealed 433 compromised components this month alone. The attackers utilize a single Solana blockchain address for command-and-control activities, showcasing a sophisticated approach to their malicious operations.

Initially observed in October 2025, GlassWorm employs invisible Unicode characters to conceal its malicious code. This tactic allows it to harvest sensitive information such as cryptocurrency wallet data and developer credentials. The latest wave of attacks has expanded significantly, targeting various platforms and introducing new methods to evade detection.

Who's Being Targeted

The attack primarily affects developers using GitHub, npm, and VSCode/OpenVSX. Specifically, it has compromised:

• 200 Python repositories on GitHub
• 151 JavaScript/TypeScript repositories on GitHub
• 72 VSCode/OpenVSX extensions
• 10 npm packages

The initial compromise occurs when attackers gain access to GitHub accounts, allowing them to push malicious commits. This enables the publication of harmful packages and extensions that contain obfuscated code, which is designed to evade security measures.

Signs of Infection

Developers should be vigilant for signs of compromise. Key indicators include:

• The presence of the variable “lzcdrtfxyqiplpd” in the codebase.
• An unexpected ~/init.json file, which is used for persistence.
• Unusual Node.js installations in the home directory, such as ~/node-v22*.
• Suspicious i.js files in recently cloned projects.

Additionally, reviewing Git commit histories for anomalies, such as significant discrepancies between the committer date and the original author date, can help identify compromised repositories.

How to Protect Yourself

To safeguard against the GlassWorm malware, developers should take proactive measures. Here are some recommended actions:

• Regularly check for the aforementioned markers in your codebase.
• Inspect systems for unexpected files or installations that may indicate compromise.
• Be cautious when installing Python packages directly from GitHub or running cloned repositories.

By staying informed and vigilant, developers can better protect themselves against this evolving threat. As the malware continues to adapt, it's crucial to remain aware of the tactics employed by these threat actors.