The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, ...

A tiny in-memory async messaging library, paired with a VS Code extension that detects common misuse at edit time. This project exists as a demo: the library is intentionally useless so the focus ...

When I open my local copy of my tracking repo of the microsoft/vscode repo I get this message in the Extension Host output channel: 2026-03-05 16:37:29.200 [info ...

GlassWorm campaign injects malware into GitHub Python repos using stolen tokens since March 8, 2026, exposing developers to ...

The Glassworm campaign has compromised over 151 GitHub repositories and npm packages using invisible Unicode payloads that ...

One IDE to rule them all. You won't want to use anything else.

A "coordinated developer-targeting campaign" is using malicious repositories disguised as legitimate Next.js projects and technical assessments to trick victims into executing them and establish ...