Socket: GlassWASM

What it is

Detailed IOC and detection breakdown for GlassWASM, the WASM malware in two trojanized Open VSX extensions. The single carrier file is snqpkebiwrxmoivl.wasm (SHA-256 558b4f1d9a263c13756ab0126c09dd080c85ba405b29488e1c4e6aa68b554f1f, 824,552 bytes, WebAssembly MVP v1, TinyGo→js/wasm). Both extensions were uploaded by one Open VSX account, zaitoona43 (GitHub UID 291961103, account only 3 days old at publication): ExarGD/vsblack@0.0.1 (2026-06-09) and noellee-doc/flint-debug@0.1.1 (2026-06-10). Open VSX has since removed both.

How it works

The malicious clones reproduce the originals' exact publisher ID, name, version, description, README, and repo links, then append two things: the ChaCha20-obfuscated WASM payload and an onStartupFinished activation hook that auto-runs it. A renamed TinyGo loader instantiates the module via go.run(). At runtime the module polls the Solana mainnet JSON-RPC API for transactions to an attacker-controlled wallet, reads instructions from the on-chain SPL Memo field, and builds an OS-specific download-and-execute command through Node's child_process. No server to sinkhole — operators rotate infrastructure by posting a new transaction.

Preconditions / Affected

Matters for users of Open VSX-backed editors — VSCodium, Gitpod, Cursor, Windsurf, and other VS Code forks that default to Open VSX rather than the VS Code Marketplace. The genuine Marketplace listings (noellee-doc.flint-debug v0.1.1 from June 2020; ExarGD.vsblack v0.0.1 from July 2019) are clean; the Marketplace verifies publisher ownership, so the impersonation only works on Open VSX. Both originals are long-dormant projects unlikely to be monitored by their authors.

What to do

• Remove ExarGD/vsblack@0.0.1 and noellee-doc/flint-debug@0.1.1 if installed from Open VSX; block publisher zaitoona43.
• Hunt for the file hashes (SHA-1 8ebac142e34a20c297d3ccaca7ee5d9ddd24fed4, MD5 4e143876eeaf5e767a9971f603b0f13c).
• Signature/YARA on the TinyGo js/wasm fingerprint rather than strings (all consequential strings are ChaCha20-encrypted, name/debug section stripped): import table shows the gojs bridge and wasi_snapshot_preview1.* imports; export table shows TinyGo's asyncify goroutine scheduler.
• Flag extensions whose payload reaches Solana JSON-RPC or invokes child_process from an onStartupFinished hook.

The blog states it documents (though not all values are in this excerpt) the live RPC endpoint, watched wallet address, memo program IDs, and verbatim shell/PowerShell payload templates — pull those from the source for detection.

Caveats

Attribution to the GlassWorm developer is medium confidence, based on tradecraft/target overlap and shared artifacts; the WASM/TinyGo stager is described as a new pivot. IOCs are as of publication — the C2 design lets operators rotate second-stage infrastructure at will.