Back in the early 2000s, customizing your MySpace profile was practically a rite of passage. Everyone wanted glittering text, autoplaying songs, and unique layouts that stood out from the rest.

While digging through my old files this week, I found a forgotten relic — a Visual Basic 6 program I wrote that generated full HTML code for MySpace profiles. All you had to do was choose colors, backgrounds, and layout preferences, and it would instantly spit out the code to paste into your “About Me” or “Interests” section.

It had a simple GUI, a few dropdowns for themes, and a preview box that updated live — which, for a VB6 project made on Windows XP, felt like magic at the time. The best part was watching friends copy and paste the generated HTML and seeing their profiles transform.

Looking back, it’s wild to realize how much that little project shaped my interest in coding, UI design, and automation. It was clunky, full of hard-coded strings, and definitely not following any kind of software architecture principles — but it worked, and it taught me how code could make creativity accessible to anyone.

I’m considering rebuilding it someday as a nostalgic web-based generator — maybe even using modern tools like React and Tailwind CSS — just for the fun of it.

Cybersecurity researchers discovered GlassWorm, a self-propagating worm spreading through Visual Studio Code extensions. This sophisticated supply chain attack has infected 14 extensions with 35,800+ downloads.

What Makes GlassWorm Dangerous?
- Uses invisible Unicode characters to hide malicious code from developers
- Leverages Solana blockchain for command-and-control (resilient to takedowns)
- Steals credentials (npm, GitHub, Git, Open VSX tokens)
- Drains 49 different types of cryptocurrency wallets
- Installs SOCKS proxy and hidden VNC for remote access
- Auto-updates through VS Code without user interaction

Infected Extensions (14):
- codejoy.codejoy-vscode-extension (1.8.3, 1.8.4)
- cline-ai-main.cline-ai-agent (3.1.3)
- CodeInKlingon.git-worktree-menu, SIRILMP.dark-theme-sm
- And 10 more extensions

How It Works:
Attackers compromise extension publisher accounts, inject malicious code using Unicode variation selectors (literally invisible in code editors), and use Solana blockchain transactions to store encrypted C2 commands. The malware then steals credentials and uses them to compromise MORE extensions, creating a self-propagating worm.

Free Scanner Tools:
I created detection tools in both Python (cross-platform) and PowerShell (Windows):

https://sevenlegend.io/?page=codes

The scanners detect:
✓ All 14 known infected extensions
✓ Invisible Unicode characters in code
✓ Blockchain C2 patterns
✓ Credential theft indicators
✓ System compromise (SOCKS proxy, VNC servers)

If You're Infected:
1. Run the scanner with --remove flag
2. Rotate ALL credentials (GitHub, npm, Git, API keys)
3. Check cryptocurrency wallets for unauthorized transactions
4. Scan for system-level compromise
5. Disable VS Code auto-updates temporarily

Source: Koi Security Research
https://www.koi.ai/blog/glassworm-first-self-propagating-...