This threat involves malicious Visual Studio Code extensions distributed through the Open VSX marketplace that carry WebAssembly malware encrypted with ChaCha20 and compiled with TinyGo. The malware polls the Solana blockchain for command-and-control instructions embedded in transaction memos, a novel dead-drop method that allows attackers to rotate infrastructure without relying on hardcoded servers. Upon activation, the malware reads instructions from a monitored Solana wallet and executes platform-specific commands via Node.js child_process to download and execute second-stage payloads. The campaign impersonates legitimate extensions targeting various VS Code forks, exploiting trust gaps between extension registries. The activity is attributed with medium confidence to the GlassWorm adversary group and represents a new variant of supply chain compromise using WebAssembly.

The malware enables attackers to remotely control infected systems by retrieving commands from the Solana blockchain, allowing dynamic and resilient command-and-control infrastructure. This can lead to the deployment of additional malicious payloads on compromised systems. The use of trusted extension marketplaces and impersonation of legitimate extensions increases the risk of widespread infection among users of VS Code forks. The supply chain compromise vector undermines software integrity and user trust in extension ecosystems.

No official patch or remediation is indicated in the provided data. Users should avoid installing extensions from untrusted or unofficial sources such as the Open VSX marketplace, especially those impersonating legitimate extensions. Monitoring for known indicators of compromise such as the listed IP addresses, hashes, and domains (e.g., dodod.lat) can help detect infections. Vendors and marketplace operators should review and strengthen extension vetting processes to prevent trojanized extensions. Patch status is not yet confirmed — check vendor advisories and marketplace updates for current remediation guidance.