A new and ongoing supply-chain attack is targeting developers on the OpenVSX and Microsoft Visual Studio marketplaces with self-spreading malware called GlassWorm that has been installed an estimated 35,800 times. The malware hides its malicious code by using invisible characters. It can also spread itself using stolen account information to infect more extensions the victim can access. GlassWorm operators use Solana blockchain for command-and-control, making takedown very difficult, with Google Calendar as backup option. Microsoft Visual Studio and the OpenVSX platforms host extensions and integrations for Visual Studio products and are constant targets of threat actors looking to steal cryptocurrency [1, 2, 3]. Researchers at endpoint security provider Koi found that the current…