Checking VS Code theme-extension risk: GlassWorm-related IDs and disabling steps

Separate the investigation scope from what you actually have installed

Socket published its theme-extension investigation on October 2, 2026, identifying the analyzed Marketplace builds of microsoftvs.microsoftvs and cosmic-themes.theme-cosmic-nebula as confirmed malicious. This article checked the original report on October 5, Beijing time, and does not treat later social posts as the first disclosure.

The investigation also lists five related IDs: holiday-themes.theme-coca-cola-christmas, lohsebhipolg2s.theme-aurora-borealis, aurora-them-creator.theme-aurora-nocturne, solidity-syntax.deep-focus and charcoal-mint-studio.theme-charcoal-mint. A relationship does not mean every build is confirmed to contain a malicious payload. The related Aurora Nocturne ID is also different from microsoftvs.microsoftvs.

The report says no active payload was observed in the analyzed Coca-Cola Christmas and Aurora Borealis versions. This check did not verify current store availability package by package, and those findings do not establish that all historical versions are safe or affected. Identify the package first rather than judging from its theme name, icon or installation count alone.

Step one: record IDs and versions from the installed list

Open the VS Code installation you actually use and enter @installed in the Extensions view, or run Extensions: Focus on Installed View from the command palette. Inspect installed content first; Marketplace search results are not a local inventory.

Open the extension to inspect and verify its publisher.extension identifier in Marketplace Info on the details page. Record its display name, ID and version. To locate a specific ID, use @id:publisher.extension for an exact search, then confirm whether it is installed. Record similar names with different publishers separately rather than merging them.

If the VS Code command-line entry point is configured, the following read-only command also lists installed IDs and versions. It neither installs extensions nor runs investigation samples.

code --list-extensions --show-versions

If the terminal cannot find code, check the command-line entry point using official CLI documentation or use the graphical interface directly. Do not download suspicious VSIX files merely to view the list, or run repair scripts from unknown sources. Keep the check time and original list for comparing before/after states.

Step two: confirm the Profile and environment to avoid gaps

VS Code Profiles can retain different extension sets. Check which Profile the current window uses, then inspect other Profiles actually used for work. Checking one window cannot establish that the others have no related extensions.

The official CLI supports --profile to specify the inventory scope. Replace the example name with a Profile you have confirmed exists instead of copying a nonexistent name.

code --list-extensions --show-versions --profile "Actual Profile Name"

If the team uses another computer, remote-development window or different editor client, confirm the installed list and extension source in each environment separately. One local list does not cover every environment. This article checks VS Code management operations. Other clients using Open VSX require their own management entry points; do not mechanically apply code commands to them.

Step three: follow prompts to update extension state after disabling or uninstalling

After recording the relevant installed identity, open the extension’s management menu in the Extensions view. Choose Disable to stop using it first, or Uninstall to remove the installed package. These have different outcomes: a disabled extension may still appear in the installed list; after uninstalling, check whether it has been removed from that Profile.

Current official documentation says these actions may prompt Restart Extensions to update extension-host state. Follow the actual interface prompt, then return to the same Profile’s list to verify the result. Clicking a button alone does not establish that the change has taken effect.

The CLI also supports uninstalling by exact ID. The following illustrates the parameter format. Before executing it, replace publisher.extension with the confirmed target ID and check the Profile.

code --uninstall-extension publisher.extension --profile "Actual Profile Name"

If the result differs from expectations, first check whether the action targeted another VS Code installation, a different Profile or another runtime environment, then confirm that interface prompts were completed. Do not broaden the action by deleting the entire extensions directory. If dependencies or team-management requirements apply, retain the inventory for the responsible maintainer to review.

Final verification: extension state and prior effects are separate questions

Read the installed list for the same scope again and compare IDs and versions to verify uninstall results. Confirm disabled state in the extension interface; the listing command does not report it. Record devices, Profiles and clients not yet checked. A current list cannot reconstruct the complete installation history.

Socket notes that uninstalling cannot reverse the effects of a payload that has already executed. If a confirmed malicious build was installed, retain installation records and have the security owner investigate subsequent execution and development credentials.

The final record should answer three questions: which installation environment was checked, which complete ID was found, and how far extension-state handling and follow-up investigation have progressed separately. This helps avoid acting on unrelated themes with the same name and lets the team continue checking areas not yet covered.