Glassworm malware has re-emerged, compromising over 150 GitHub repositories, npm, and VS Code through the use of hidden Unicode characters. This resurgence follows previous activity traced back to the same threat actor, highlighting ongoing vulnerabilities in these platforms.

The most downloaded skill on the OpenClaw marketplace was identified as malware, which stole SSH keys, crypto wallets, and browser cookies while establishing a reverse shell to the attacker's server. A total of 1,184 malicious skills were found, with one attacker responsible for uploading 677 packages, exploiting the platform's open publishing policy that allowed anyone with a week-old GitHub account to submit skills.