NEW GLASSWORM ATTACK TARGETS MACOS VIA COMPROMISED OPENVSX EXTENSIONS

Summary from the TLDR InfoSec newsletter

Researchers at Socket Security identified a new set of compromised packages on the OpenVSX marketplace that appear to be infected with the GlassWorm malware. The malware targets macOS users and harvests data from browsers, wallet extensions and wallet apps, macOS keychains, Apple Notes databases, Safari cookies, developer secrets, and documents from the local filesystem. The researchers note that the extensions operated legitimately for two years prior to infection, so it is possible that the developer was compromised.