CrowdStrike, Google and Shadowserver Pull the Plug on GlassWorm's C2
A coordinated takedown severed every known command channel of the developer-targeting worm — for now.
CrowdStrike, working with Google and the Shadowserver Foundation, said it simultaneously cut every command-and-control channel tied to GlassWorm, a campaign that has been quietly seeding malicious npm packages and VS Code extensions to software developers since at least early 2025.
The operators were not subtle about who they wanted. Developers, with their long-lived cloud tokens, signing keys and access to build pipelines, remain the most efficient way to compromise downstream organisations without going near a corporate firewall. GlassWorm leaned into that, planting tainted packages on the npm registry and the OpenVSX marketplace and pulling further instructions from a layered C2 setup that included Solana blockchain transactions as a fallback channel.
That last detail is the one worth pausing on. Using a public blockchain as a dead-drop is not novel (Glupteba was doing it years ago), but it makes takedowns harder because there is no domain to seize and no host to subpoena. CrowdStrike says the disruption knocked out the conventional C2 infrastructure and that the Solana-based fallback is being monitored. Whether "monitored" amounts to "neutralised" is a separate question.
The campaign's worm-like behaviour came from stealing developer credentials on infected machines and using them to publish further poisoned packages under legitimate maintainer accounts. Predictably, that produced a self-propagating supply chain — each compromised developer becoming the next distribution point. OpenVSX, the open marketplace used by VSCodium and several JetBrains-adjacent forks, has been pulling affected extensions on an ongoing basis.
CrowdStrike attributes the activity to a financially motivated cluster it is tracking internally, and said in its writeup that victims span multiple continents, with a noticeable concentration in cryptocurrency and DeFi engineering teams. The wallet-draining payloads suggest the operators were happy to monetise directly when the opportunity arose, rather than wait for a quieter long-game compromise.
Developers who installed any of the flagged npm packages or OpenVSX extensions between January and October are advised to rotate npm tokens, GitHub PATs, SSH keys and any cloud credentials cached on the affected workstation. A reinstall of the affected extension is not sufficient. The Shadowserver Foundation is publishing victim notifications through its usual national CERT channels.
Takedowns of this shape tend to buy weeks, not years. The infrastructure can be rebuilt, the Solana fallback was designed precisely for this contingency, and the underlying problem — that the open-source package ecosystem treats publisher identity as a soft suggestion — has not moved. The operators will be back under a different name. The marketplaces will catch some of it. And developers will keep installing extensions on Monday mornings without reading the manifest.
