CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages

The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Mar 20, 2026 Supply Chain

GlassWorm transitive dependency campaign artwork

72 Malicious Open VSX Extensions Linked to GlassWorm Campaign Now Using Transitive Dependencies

Since January 31, 2026, we identified at least 72 additional malicious Open VSX extensions, including transitive GlassWorm loader extensions targeting developers through extensionPack and extensionDependencies manifest abuse.

Mar 13, 2026 Malware, Browser Extensions

5 Malicious Rust Crates Posed as Time Utilities to Exfiltrate .env Files

Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.

Mar 10, 2026 Malware, Rust

Fake imToken Chrome extension phishing artwork

Fake imToken Chrome Extension Steals Seed Phrases via Phishing Redirects

Mixed-script homoglyphs and a lookalike domain mimic imToken's import flow to capture mnemonics and private keys.

Mar 5, 2026 Malware, Browser Extensions

Malicious Go "crypto" Module Steals Passwords and Deploys Rekoobe Backdoor

An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.

Feb 26, 2026 Malware, Supply Chain

SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains

An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Feb 20, 2026 Malware, Supply Chain

Malicious Chrome extension CL Suite artwork

Malicious Chrome Extension Steals Meta Business Manager Exports and TOTP 2FA Seeds

Chrome extension CL Suite by @CLMasters neutralizes 2FA for Facebook and Meta Business accounts while exfiltrating Business Manager contact and analytics data.

Feb 13, 2026 Malware, Browser Extensions

GlassWorm Loader Hits Open VSX via Developer Account Compromise

Threat actors compromised four oorzc Open VSX extensions with more than 22,000 downloads, pushing malicious versions that install a staged loader, evade Russian-locale systems, pull C2 from Solana memos, and steal macOS credentials and wallets.

Jan 31, 2026 Malware, Browser Extensions

PyPI Package Impersonates SymPy to Deliver Cryptomining Malware

Malicious PyPI package sympy-dev targets SymPy users, a Python symbolic math library with 85 million monthly downloads.

Jan 21, 2026 Malware, PyPI

Malicious Chrome Extension Steals MEXC API Keys for Account Takeover

A malicious Chrome extension steals newly created MEXC API keys, exfiltrates them to Telegram, and enables full account takeover with trading and withdrawal permissions.

Jan 12, 2026 Malware, Browser Extensions