GlassWASM: WebAssembly Malware Found in Trojanized Open VSX Extensions

**Executive summary:** Socket Threat Research discovered trojanized Open VSX VS Code extensions that ship a TinyGo-compiled WebAssembly payload which decrypts strings in-memory, polls a Solana wallet for SPL Memo instructions to obtain a rotating C2 host (dodod.lat), and uses Node's child_process to run platform-specific download-and-execute commands; the report provides file hashes, affected packages, behavioral indicators, mitigation guidance, and attributes the sample with medium confidence to the GlassWorm campaign.