WaterPlum Deploys New ‘StoatWaffle’ Malware in VSCode-Based Supply Chain Campaign

StoatWaffle is a new, modular Node.js malware deployed by North Korea-linked WaterPlum (Team 8) via fake VSCode blockchain project repositories that exploit VSCode workspace trust and runOn:folderOpen to silently execute a bootstrapper, install Node.js if necessary, and fetch staged loaders that deploy credential-stealing and RAT modules; NTT Security’s March 17, 2026 report includes C2 IPs and IOCs and recommends restricting runOn:folderOpen, monitoring unexpected Node.js installs, and blocking listed IPs.