WaterPlum Unleashes “StoatWaffle” Malware in VSCode Supply Chain Attack

StoatWaffle — a newly reported modular malware attributed to the North Korea-linked WaterPlum (Team 8) — is distributed through malicious VSCode repositories that auto-execute a tasks.json task when a developer opens and trusts the project. The chain installs or uses Node.js, fetches loaders (env.npl, vscode-bootstrap.cmd) from Vercel-hosted endpoints, and deploys stealer and RAT modules that exfiltrate browser credentials, extension data, macOS Keychain secrets, and system profiles while maintaining persistent C2 communications; the campaign specifically targets blockchain developers and abuses trusted development tooling, including WSL-aware path handling.