Executive Summary
Since May 2026, a threat actor known as GLASSWORM has targeted developers via the Open VSX marketplace using a series of sophisticated malicious extensions. The latest iteration, GLASSWORM.WASM, utilizes TinyGo-compiled WebAssembly (WASM) modules to obfuscate a loader that facilitates the final stage delivery of OS-specific implants via PowerShell or Bash. This campaign is notable for its use of the Solana blockchain as a 'dead-drop' primitive; the malware queries public Solana transaction memos associated with a specific wallet to resolve the current command-and-control (C2) domain.
Technically, the WASM modules use a dual-layered encryption scheme involving ChaCha20 and a rolling XOR mask to hide strings. By moving I/O operations to a JavaScript shim via the `syscall/js` bridge, the loader remains largely opaque to traditional static analysis tools. This actor has demonstrated high operational agility, previously using Rust-compiled native addons and JavaScript-based droppers. The move to WASM represents a significant attempt to evade detection in developer toolchain environments.