GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs

Why It Matters

The attack demonstrates how supply‑chain compromises can weaponize developer tools, giving threat actors broad, persistent access to codebases and corporate secrets. It underscores the urgent need for stricter vetting of IDE extensions across the software industry.

Key Takeaways

• GlassWorm uses Zig-compiled native binary in fake WakaTime extension
• Binary drops malicious VSIX that infects all VS Code‑compatible IDEs
• Second‑stage extension contacts Solana blockchain for C2 and avoids Russian systems
• Attack installs RAT and a Chrome data‑stealing extension
• Researchers advise removal and immediate credential rotation

Pulse Analysis

Supply‑chain attacks on developer ecosystems have accelerated as attackers recognize the privileged position of IDE extensions. Native binaries compiled with languages like Zig can bypass JavaScript sandbox restrictions, granting malware OS‑level privileges. By embedding such a binary in a popular‑looking WakaTime tracker, the GlassWorm actors leveraged the trust developers place in productivity tools, expanding the attack surface beyond a single editor to any environment that supports VS Code extensions.

The GlassWorm chain is notable for its multi‑stage sophistication. After the initial dropper identifies every compatible IDE—including VS Code, VSCodium, Cursor, and others—it fetches a counterfeit VSIX from a GitHub account, impersonating a legitimate extension with millions of installs. The second‑stage payload then reaches out to the Solana blockchain to resolve its C2 endpoint, a technique that adds resilience against takedown efforts. It also includes a geo‑check to skip Russian systems, likely to avoid attribution, and proceeds to install a remote‑access trojan and a Chrome extension designed to siphon browsing data.

For organizations, the incident is a wake‑up call to enforce strict extension governance. Automated scanning for native binaries, code‑signing verification, and limiting IDE extension installations to vetted repositories can reduce exposure. Incident response teams should prioritize detection of anomalous native addon loads and monitor network traffic for blockchain‑related queries. As attackers continue to weaponize emerging compile‑to‑native languages, a proactive, layered defense strategy will be essential to protect development pipelines and the intellectual property they contain.