GlassWorm Expands to 433 Repos Across GitHub, npm, and VSCode
TL;DR
A renewed GlassWorm supply-chain campaign has compromised 433 components across GitHub, npm, and VSCode/OpenVSX, spreading via compromised accounts, obfuscated code, and a Solana-based C2 to harvest wallet data, credentials, and environment info; indicators include marker lzcdrtfxyqiplpd and init.json persistence, with warnings to inspect for rogue Node.js installs and unusual commit histories.
- GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX BleepingComputer
- Glassworm Returns: Invisible Unicode Malware Found in 150+ GitHub Repositories Aikido Security
- ForceMemo: Python Repositories Compromised in GlassWorm Aftermath SecurityWeek
- GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos The Hacker News
- GlassWorm Malware Evolves to Hide in Dependencies Dark Reading
Want the full story? Read the original reporting
Read on BleepingComputer