Introduction: When Developer Trust Becomes the New Attack Surface The software development ecosystem has become one of the most attractive targets for modern cybercriminals because developers often have privileged access to source code, cloud environments, internal systems, and production infrastructure. A single compromised development tool can become a silent gateway into organizations that would otherwise have strong security defenses. A recent discovery by security researchers has revealed a sophisticated malware campaign involving trojanized Open VSX Visual Studio Code extensions.

Socket’s Threat Research team uncovered trojanized Open VSX Visual Studio Code extensions that delivered a TinyGo-compiled WebAssembly payload and used Solana memos as a takedown-resistant command-and-control dead drop. The campaign, attributed with medium confidence to the GlassWorm developer, was dubbed “GlassWASM” and involved packages impersonating ExarGD.vsblack and noellee-doc.flint-debug. #GlassWASM #OpenVSX #Solana #GlassWorm

The trojanized extensions use TinyGo-compiled WebAssembly and Solana transaction memos to resolve command-and-control infrastructure.