GCVE-110-OSM-2026-443

New sleeper Open VSX extension added to the GlassWorm cluster in the 2026-04-29 wave. Currently benign but operator-controlled and staged for runtime activation following the same pattern as previously confirmed payloads. === GlassWorm Open VSX Campaign === Multi-stage supply chain attack targeting VS Code, Cursor, Windsurf, and VSCodium. === STAGE 1: Obfuscated Loader === Heavily obfuscated JavaScript bundled in the extension decodes at runtime to fetch a secondary .vsix payload from attacker-controlled GitHub repos: - https://github.com/SquadMagistrate10/wnxtgkih - https://github.com/francesca898/dqwffqw - https://github.com/ColossusQuailPray/oiegjqde === STAGE 2: Native Binary Execution === Platform-specific .node binaries embed GitHub URLs and IDE installation logic targeting VS Code, Cursor, Windsurf, and VSCodium directories. === STAGE 3: Transitive Delivery (2026-04-29 wave) === Sleeper extensions reference blockstoks.easily-gitignore-manage via extensionPack/extensionDependencies — installing one extension silently pulls in the GlassWorm component. === File Hashes (SHA256) === Native installer binaries: - 1b62b7c2ed7cc296ce821f977ef7b22bae59ef1dcdb9a34ae19467ee39bcf168 - 4ebfe8f66ca7e9751060b3301b5e8838d6017593cdae748541de83bfa28183bd Downloaded VSIX payload: - 97c275e3406ad6576529f41604ad138c5bdc4297d195bf61b049e14f6b30adfd