TLDR Tech / InfoSec
GlassWASM: WebAssembly Malware Found in Trojanized Open VSX Extensions
GlassWASM is a TinyGo-compiled WebAssembly payload hidden in two trojanized Open VSX extensions (ExarGD.vsblack@0.0.1 and noellee-doc/flint-debug@0.1.1) published by impersonation account zaitoona43 and attributed with medium confidence to the GlassWorm operator. The module ships zero plaintext IOCs, decrypting strings via an embedded ChaCha20 routine at runtime and polling a Solana wallet for SPL Memo dead-drops that resolve a rotating C2 host before running a cross-platform curl/PowerShell download-and-execute through Node child_process. Remove both packages from Open VSX-default editors, treat any host that activated them as having run an unknown second stage, and detect on the execution chain rather than the rotating host.
Read the full story