GlassWorm Dissected: How a Self-Propagating Worm Uses Solana as C2 Infrastructure to Compromise Developer Environments

TL;DR GlassWorm is a self-propagating supply chain worm that abuses VS Code extensions to steal developer credentials, drain 49 types of cryptocurrency wallets, and deploy RATs — using Solana blockchain transactions as an unkillable command-and-control channel. On March 13, 2026, researchers identified 72 new malicious extensions using transitive dependency attacks to bypass marketplace review. This article dissects the kill chain, explains the Solana dead drop resolver technique, and provides concrete detection and defense strategies. Why Developers Should Care If you write code, you're the target. Not your users. Not your protocol. You. GlassWorm doesn't exploit smart contracts. It exploits the humans who write them. One infected VS Code extension gives attackers: NPM tokens, GitHub credentials, Git tokens — your entire supply chain identity 49 cryptocurrency wallet types — direct fund theft SOCKS proxy on your machine — you become criminal infrastructure Hidden VNC (ZOMBI RAT) — ful