CrowdStrike and Google block ‘Glassworm’ botnet targeting open-source software developers

CrowdStrike said it worked with Google and Shadowserver Foundation to disrupt Glassworm, a botnet targeting open-source developers.

Glassworm spread via malicious VS Code extensions and npm/Python packages to steal credentials and inject code into GitHub repositories.

The campaign was designed to move through software supply chains, turning one compromise into downstream infections across many organizations.

Taking down the infrastructure helps reduce large-scale supply-chain risk for developers and CI/CD pipelines.