GlassWorm

GlassWorm is a worm that propagated through supply chain attacks by compromising repository credentials from victim environments and having malicious payloads added to those compromised accounts for distribution to victims across the various development ecosystems.^[1][2][3] GlassWorm has numerous variants, including Rust binaries, encrypted JavaScript and a variant leveraging invisible Unicode characters that made reverse engineering difficult.^[4][1][5] GlassWorm has employed a unique command and control (C2) methodology using Solana blockchain.^[6][1] GlassWorm was first reported in October 2025.^[6][1][3]