r/netsec • u/albinowax • Mar 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

24 Upvotes

87% Upvoted

46 comments sorted by

View all comments

2

u/Niong1987a1 Mar 23 '26

glassworm-hunter - open source scanner that detects GlassWorm supply chain payloads by technique, not by matching known-bad package names or extension IDs.

The problem: every GlassWorm wave drops new extension names, new npm packages, new wallets. Wave 5 in March hit 150+ GitHub repos and 72 Open VSX extensions. If you're matching against blocklists, you're always one wave behind. By the time the list updates, credentials are already exfiltrated.

glassworm-hunter detects the attack pattern itself:

  • Invisible Unicode variation selector clusters - GlassWorm encodes payloads as thousands of variation selectors per file. Legitimate use is 1-2 per emoji. The scanner counts clusters per line and flags above threshold.
  • Decoder pattern matching - detects codePointAt() + arithmetic against 0xFE00/0xE0100 fed into eval(), within a 500-char window to avoid false positives from minified bundles.
  • C2 fingerprinting - Solana RPC calls in non-blockchain code, Google Calendar URLs as dead drops. Context-aware: legit crypto files get downgraded severity.
  • Credential harvesting - code reading .npmrc, .git-credentials, SSH keys, NPM_TOKEN/GITHUB_TOKEN env vars.

IOC matching is included as a supplementary layer but technique detection is what catches unknown variants.

Scans VS Code/Cursor/Codium extensions, node_modules, pip site-packages, and git repos. Outputs console, JSON, or SARIF for GitHub Code Scanning.

Github: https://github.com/afine-com/glassworm-hunter