CrowdStrike, Google, and the Shadowserver Foundation dismantled the GlassWorm malware operation, but experts say the broader chaos unfolding across open-source ecosystems is making isolated takedowns feel increasingly temporary.

The four C&C channels used by GlassWorm, the botnet targeting open source software developers, have been disrupted.

GlassWorm poisoned 300 GitHub repositories since 2025, enabling supply chain attacks against developers and organizations.