Threats Tagged 'glasswasm'

Trojanized Visual Studio Code extensions distributed via the Open VSX marketplace contain sophisticated WebAssembly-based malware. These extensions include ChaCha20-encrypted TinyGo-compiled WebAssembly modules that use the Solana blockchain to receive command-and-control instructions embedded in transaction memos. This technique enables attackers to avoid hardcoded infrastructure by using a blockchain dead-drop for commands. The malware executes platform-specific download-and-execute commands via Node.js to deploy additional payloads. The campaign targets VS Code forks like VSCodium, Cursor, and Windsurf by impersonating legitimate extensions and exploiting cross-registry trust gaps. Attribution is linked with medium confidence to the GlassWorm threat actor group, representing a novel WebAssembly-based supply chain compromise variant.