Apr 27, 2026mediumsupply-chain

GlassWorm malware attacks return via 73 OpenVSX "sleeper" extensions

A new wave of the Glassworm campaign is targeting the OpenVSX ecosystem with 73 "sleeper" extensions that turn malicious after an update.

what's affectedGlassWorm malware attacks return via 73 OpenVSX "sleeper" extensions

mitigation statusMonitoring updates

first reportedApr 27, 2026

mentions (24h)120

velocitytrend flat

mentions delta-9% vs yesterday

platform splitX 71% · Reddit 30% · GitHub 8%

keywords

supply-chainvulnerabilitymitigation

x analyticsheat 16 (flat)

authors 8verified 0%

likes38

retweets14

replies0

quotes3

summaryLive chatter is accelerating; analysts are actively validating impact.

Curated Apr 27, 2026 by the ahackaday team./Sources verified./Brief grounded in 1 source.

Grace Your AI security internreadyGrace is ready

Grounded in this brief only — GlassWorm malware attacks return via 73 OpenVSX "sleeper" extensions. Press ⌘K any time.

You're answering aschange anytime

Pick a playor type your own ↓

Tone

Pick a play above, or type your question

Generate an answer and Grace will return a grounded response for this incident.

scanning advisory feeds…