What Happened

Security researchers disclosed this week that the GlassWorm campaign - previously known for poisoning npm packages and GitHub repositories with invisible Unicode payloads - has evolved. The latest variant uses a Zig-compiled native binary hidden inside a fake Open VSX extension to silently infect every VS Code-compatible IDE on a developer's machine.

The malicious extension, published as specstudio.code-wakatime-activity-tracker, impersonates WakaTime, a widely used coding-activity tracker. It has since been removed from Open VSX, but the damage window was significant.

How the Zig Dropper Works

Unlike typical malicious extensions that rely on JavaScript alone, GlassWorm ships a Zig-compiled native binary alongside its JS code. On Windows it appears as win.node; on macOS as mac.node. These files are Node.js native addons - compiled shared libraries that load directly into Node's runtime and execute outside the JavaScript sandbox with full OS-level access.

Once loaded, the binary:

  1. Scans for every IDE on the system that supports VS Code extensions
  2. Downloads malicious .VSIX files from a GitHub account (ColossusQuailPray)
  3. Installs them silently using each editor's CLI tools
  4. Deletes its own installer traces

The list of targeted editors includes VS Code, VS Code Insiders, VSCodium, Positron, and AI-powered coding tools like Cursor and Windsurf. If it supports .vsix extensions, GlassWorm will find it and infect it.

The Second Stage

The dropper installs a second extension named floktokbok.autoimport, which impersonates the legitimate steoates.autoimport package. This second-stage extension:

  • Checks the system locale and skips execution on Russian-language systems
  • Queries the Solana blockchain to dynamically resolve its command-and-control server address - a clever anti-takedown technique since blockchain records cannot be easily removed
  • Exfiltrates sensitive data including environment variables, SSH keys, and credentials
  • Deploys a remote access trojan (RAT) for persistent access
  • Installs a malicious Chrome extension that steals browser data

Why This Matters for Developers

The attack chain runs end-to-end against the tools developers use every day. A real package on a real marketplace, a Zig native addon executing outside the JS sandbox, and exfiltration of SSH keys and credentials from any VS Code-compatible editor on the machine.

The choice of Zig as the compilation language is deliberate. Zig produces small, dependency-free binaries that evade most static analysis tools. The binary format looks like a legitimate native addon, the kind many extensions already ship for performance reasons.

The Solana-based C2 resolution is particularly nasty. Traditional domain takedowns do not work here. The attacker writes a C2 address to the blockchain, and the malware reads it. Law enforcement cannot simply seize a domain to kill the campaign.

Detection

Check your installed extensions immediately:

# Check VS Code directly
code --list-extensions | grep -i "floktokbok\|specstudio"

# Check Cursor
cursor --list-extensions | grep -i "floktokbok\|specstudio"

Look for these IOCs:

  • Extension ID: specstudio.code-wakatime-activity-tracker
  • Extension ID: floktokbok.autoimport
  • GitHub account hosting payloads: ColossusQuailPray
  • Native addon filenames: win.node, mac.node

If any of these appear on your system, assume full compromise. Rotate all API keys, SSH keys, tokens, and credentials that were accessible from the infected machine.

The Broader Pattern

GlassWorm started with invisible Unicode characters in npm packages and GitHub repos. Now it has moved to compiled native binaries in IDE extensions. The trajectory is clear: supply-chain attacks on developer tools are getting more sophisticated, and the marketplaces we trust are not keeping up.

Responsible publishers manually sign and review every release of an IDE extension before it ships. Open VSX accepted a typosquatted package shipping a Zig native addon and pushed it to anyone who searched for "wakatime".

Open VSX removed the extension after disclosure. The harder question is why a package shipping a Zig binary as a native addon did not trigger any automated review before publication.