The GlassWorm threat actor has taken another significant step forward. Tracked since early 2025 for using invisible Unicode characters to hide payloads in npm packages, this group has a history of compromising developer tools.
Recently, researchers at Aikido uncovered a new campaign in which GlassWorm delivers a persistent Remote Access Trojan (RAT) via a malicious OpenVSX extension.
This latest attack specifically targets users of popular development environments, including VS Code, Cursor, and Windsurf.
Escaping The Sandbox With Native Code
The attackers use a trojanized extension called code-wakatime-activity-tracker. On the surface, it looks and acts exactly like the legitimate WakaTime developer tool.
It prompts for API keys, registers normal commands, and shows the correct status bar icons. However, the hidden danger lies in its activation process.
const bw = process.platform === "win32" ? "./bin/win.node" : "./bin/mac.node";
const { install } = require(bw);
install();Before running any normal tracking logic, the extension quietly loads a native binary bundled inside its files.
Depending on the operating system, it executes a compiled shared library, either on Windows. node for Windows or mac. node for macOS.
These files are written in Zig and act as Node.js native add-ons. Because they run directly in the Node runtime, they bypass the standard JavaScript sandbox. This grants the malware full operating system-level access to the victim’s machine.
Cross-IDE Infection and Final Payload
Once the native binary is active, its primary goal is to hunt down other development environments. It scans the system for editors that share the VS Code extension architecture.
The malware targets a wide range of popular IDEs:
- Visual Studio Code and VS Code Insiders
- AI-powered editors like Cursor and Windsurf
- Open-source alternatives like VSCodium and Positron
This broad targeting means that if a developer uses Cursor but still has VS Code installed in the background, the malware will compromise both.
After building a list of installed editors, the binary downloads a malicious extension file from an attacker-controlled GitHub repository. This file pretends to be steoates.autoimport, a highly popular VS Code extension.
Using each editor’s command-line interface, the binary silently installs this fake extension in every discovered IDE, then deletes the downloaded file to cover its tracks.
According to Aikido research, this secondary extension is the main GlassWorm dropper.
It avoids infecting systems in Russia, communicates with a command-and-control server built on the Solana blockchain, and ultimately drops a persistent RAT that can steal session cookies and log keystrokes.
Suppose you spot specstudio/code-wakatime-activity-tracker or floktokbok.
If you import into your extensions list, you should consider your system compromised and immediately rotate any exposed credentials.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
