WebAssembly Stager Hides in Fake VS Code Extensions, Uses Solana for C2
Researchers uncovered GlassWASM, a TinyGo‑compiled WebAssembly stager embedded in two counterfeit Open VSX extensions. On activation the WASM module contacts the Solana blockchain for instructions, then fetches and runs PowerShell payloads, showcasing a novel supply‑chain attack that leverages blockchain as a dead‑drop C2.