|

Threat Intelligence | On-Chain Backdoor in a Malicious TRAE Extension

https://x.com/Will42W/status/2077938237704958154

MistEye Response

MistEye is a Web3 menace intelligence and dynamic safety monitoring system independently developed by SlowMist. It integrates safety monitoring and intelligence aggregation capabilities to offer customers with real-time threat alerts and asset safety.

MistEye promptly synchronized the chance by intelligence notifications and buyer alert channels.

2. Analysis of the Malicious Extension

2.1 Impersonating the Legitimate Solidity Extension

The extension writer is known as juannegro, impersonating the official Solidity extension developed by Juan Blanco. It instantly copied the latter’s description, icon, and repository info. The names juannegro and the authentic writer juanblanco differ by solely a few letters, making it simple for customers to miss the distinction.

According to the knowledge offered by Will and official data from Open VSX, the extension was revealed on May 1, 2026, and was found and eliminated inside hours. Currently, Open VSX API queries return “extension not discovered,” however as of July 18, TRAE was nonetheless in a position to seek for and obtain juannegro.solidity@0.0.189.

We carried out two separate critiques and located that the downloadable model offered by TRAE remained 0.0.189. The inside model timestamp additionally remained at May 1. The solely change was the “Last Updated” discipline on the extension info web page, which doesn’t point out that the attacker uploaded a new file, however solely that the metadata was refreshed.

2.2 Malicious Extension Auto Activation

The extension’s bundle.json declares two activation occasions:

"activationEvents": [
"onStartupFinished",
"onLanguage:solidity"
],
"most important": "./out/extension.js"

onLanguage:solidity prompts the extension when customers open Solidity recordsdata, however the extra harmful one is onStartupFinished. According to the VS Code Extension API documentation, this occasion is routinely triggered after the editor finishes beginning up, with out requiring customers to open any recordsdata or execute any instructions.

Therefore, so long as the extension is put in and enabled, even when the consumer by no means opens a Solidity file, the IDE will routinely invoke the activate() perform each time it finishes beginning up or the extension course of restarts, inflicting the malicious code to start execution.

2.3 Hash Obfuscation Hiding Command Execution

In out/extension.js, the developer didn’t instantly use child_process.exec. Instead, the code first calculates SHA-256 hashes of Node.js built-in module names and performance names, then makes use of two mounted hash values to reverse-lookup and procure the strings child_process and exec. Therefore, the variable hash in the code really factors to child_process.exec.

The code then compares hash (which is definitely a perform) with a mounted string. Since a perform object can by no means equal a string, the comparability result’s at all times true, bypassing the examine and executing attempt_update(child_process.exec). The attempt_update perform makes use of the passed-in exec perform to execute system instructions, starting the set up of the persistent backdoor.

2.4 Cross-Platform Persistence

Inside attempt_update, this system first makes use of os.platform() to determine the working system, then calls exec to write down malicious recordsdata and configure corresponding startup objects primarily based on the detected platform. Once persistence is established, the malicious payload not will depend on the IDE course of and may proceed working even after the extension is uninstalled.

  • macOS: The payload is written to ~/.solidity/, quarantine attributes are eliminated, and a LaunchAgent is created to begin it routinely when the consumer logs in.
  • Linux: The payload is written to ~/.solidity/, registered as a systemd consumer service, and configured to restart after irregular termination.
  • Windows: The updater is written to C:CustomersPublicsolidity, the place it downloads and executes app.js. Related recordsdata are hidden, whereas the HKCU Run secret’s modified and an try is made so as to add Defender exclusions.

After this, Windows launches solidity-compiler.js from C:CustomersPublicsolidity, whereas macOS/Linux run the native file below ~/.solidity/. The persistence mechanism ensures that the payload could be restarted; and the place it connects after every startup is decided by the identical Ethereum contract.

2.5 Using an Ethereum Contract to Dynamically Update C2

Windows and macOS/Linux learn the identical on-chain configuration, however use completely different parameters.

The solidity-compiler.js deployed on Windows is generated from out/parts/compiler.js. The script polls a number of public RPC endpoints, reads param2() through eth_call, after which makes use of curl.exe -k to obtain and execute app.js. The -k parameter disables TLS certificates verification, and the script doesn’t confirm digital signatures or mounted hashes. When the consumer logs in once more, the HKCU Run key launches the script, which then queries the obtain handle once more.

macOS/Linux use Go executables positioned below extension/bin/, with completely different recordsdata chosen primarily based on the working system and CPU structure. The retained perform symbols in the pattern embody antivm.Check, eth.ReadParam1WithFallback, hubclient.beginShellLocked, and runCommand. Based on the decision relationships, it may be confirmed that the payload performs setting checks, reads param1() from the contract, establishes a distant Shell connection, and reconnects after disconnection.

Both forms of payloads have the identical Ethereum mainnet contract hardcoded:

0xf8a900db50b3331be6b768ba460bb59f3e40c344

After reversing the contract bytecode, two key configurations had been recognized:

  • param1() (0x02d91518) shops the distant Shell handle for macOS/Linux.
  • param2() (0x1f049b68) shops the obtain handle of the Windows second-stage payload.

The perform selectors used to replace these two parameters are 0xc832508f and 0xf56f9b48, respectively, and each are restricted by proprietor permissions. Calling proprietor() (0x8da5cb5b) reveals the controlling pockets:

0xFd3fc58bcbd8ccc77b6000201438eDfc636E7cA7

At the time of evaluate, the contract configuration was:

param1 = 107[.]189[.]27[.]46:4912
param2 = hxxp://107[.]189[.]27[.]46:3000/app.js

An contaminated host solely must provoke an eth_call request by a public RPC: Windows reads param2() to obtain app.js, whereas macOS/Linux reads param1() to connect with the distant Shell. After the attacker modifies the contract parameters, all payloads that question the contract once more will acquire the brand new handle, with out requiring the VSIX to be republished.

By putting the C2 handle in the contract, the extension bundle solely must retain the contract handle and question logic. Public RPC endpoints could be changed, that means the failure of a single node is not going to interrupt configuration retrieval; in the meantime, every parameter replace will depart an on-chain document. This article solely carried out read-only queries on the contract and didn’t hook up with the distant Shell or entry/obtain the second-stage payload. The undeniable fact that these addresses stay saved on-chain doesn’t imply the corresponding servers are at the moment reachable, nor does it show that energetic victims nonetheless exist.

2.6 On-Chain C2 Update Records

By reviewing the contract’s transaction historical past by Blockscout, we had been in a position to observe the modifications to its parameters. We filtered transactions despatched from the controlling pockets to the contract, then distinguished between param1 and param2 primarily based on the perform selectors, and instantly noticed the written content material in the UTF-8 part of the transaction enter information.

The contract was deployed on March 14, 2026, at 13:03 UTC. Twenty minutes later, the controlling pockets initiated a transaction (0x972f…) calling 0xc832508f, setting param1 to http://localhost:4912, and subsequently modified it to different public IP addresses a number of occasions. This signifies that the attacker had already been testing this on-chain management mechanism earlier than the malicious extension was revealed.

The extension was revealed on {the marketplace} on May 1. Two days later (May 3, 16:55 UTC), the controlling pockets modified param1 to 107[.]189[.]27[.]46:4912 by one other transaction (0xadea…).

On May 16, at 12:08 UTC, the identical pockets used one other transaction (0x8e5d…) to vary param2 to hxxp://107[.]189[.]27[.]46:3000/app.js.

Both transactions occurred after the VSIX was revealed, demonstrating that the attacker may change the distant Shell and second-stage obtain addresses with out updating the extension by {the marketplace}. Since the updates occurred on-chain, the extension model and replace timestamp displayed by TRAE wouldn’t change accordingly.

2.7 Removing the Extension Cannot Eliminate the Infection

TRAE didn’t synchronize the removing standing from Open VSX, inflicting VSIX recordsdata that had already been eliminated by the upstream platform to proceed being distributed. Even if the extension is urgently eliminated now, it could possibly solely stop new installations and can’t get rid of malicious payloads which have already been written to techniques.

This is as a result of the extension creates startup persistence mechanisms throughout its preliminary execution (akin to macOS LaunchAgent, Linux systemd service, and Windows registry entries), and should have already downloaded the second-stage malicious code. These residual parts is not going to be routinely eliminated when the extension is taken down or uninstalled by customers. The on-chain C2 configuration can also be impartial of the extension itself and stays efficient.

Therefore, in addition to eradicating the extension and stopping VSIX distribution, the platform also needs to notify put in customers, present detection and cleanup options, and block the menace on the shopper facet primarily based on the extension ID, file hashes, and dropped IOC indicators.

2.8 Infection Investigation and Remediation

If you’ve beforehand put in juannegro.solidity, merely uninstalling it from the IDE extension listing isn’t adequate. It is beneficial to first disconnect the community and again up suspicious recordsdata for additional forensic evaluation, then examine the next areas:

  • macOS: Check the ~/solidity/ listing and the ~/Library/LaunchAgents/com.solidity.langsupport.runner.plist file.
  • Linux: Check the ~/solidity/ listing and the ~/.config/systemd/consumer/solidity-langsupport-runner.service file.
  • Windows: Check the C:CustomersPublicsolidity listing, and confirm whether or not there are any suspicious startup entries pointing to solidity-compiler.js below the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRun; additionally examine HKCUSoftwareMicrosoftWindowsCurrentVersionEVJ (if it exists).

In addition, examine whether or not the host has community connection data involving public Ethereum RPC nodes and the next IP addresses and ports:

  • 107[.]189[.]27[.]46:4912
  • 107[.]189[.]27[.]46:3000

This malicious extension has the power to execute arbitrary instructions and set up distant Shell connections. Therefore, even after deleting the above recordsdata and registry entries, the system shouldn’t be thought-about safe. If the system has ever saved code signing keys, SSH personal keys, cloud service credentials, cryptocurrency pockets seed phrases, or manufacturing setting tokens, it ought to be dealt with in line with a host compromise response process:

  • Immediately isolate the system;
  • Reinstall the working system or rebuild the setting from trusted set up media;
  • Revoke all present periods and entry tokens from one other safe system, and change all credentials which will have been compromised.

2.9 Threat Indicators (IOC)

Extension and File Hashes

Extension: juannegro.solidity@0.0.189
VSIX SHA-256: ff943371750ecd2ce6caa50c12d673e82743bdbc9569552eebfa98ccb2f4ac69

darwin_amd64: 80d2672e2599732d3c0ae2a4cd0d1e3fe4d555a60273ce33feb99db3f34d250f
darwin_arm64: fae61f31f00988fdc5cc9e7272b51e08af2e245d81003237875415930fd27358
linux_amd64: 9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696
linux_arm64: b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565

On-Chain and Network Indicators

Contract: 0xf8a900db50b3331be6b768ba460bb59f3e40c344
Owner: 0xFd3fc58bcbd8ccc77b6000201438eDfc636E7cA7

107[.]189[.]27[.]46:4912
hxxp://107[.]189[.]27[.]46:3000/app.js
91[.]108[.]240[.]156:4912
hxxp://91[.]108[.]240[.]156:3000/app.js
107[.]189[.]16[.]215:4912

Since the contract parameters could proceed to be up to date, detection shouldn’t rely solely on the present IP addresses. It also needs to cowl indicators such because the contract handle, perform selectors, malicious file drop paths, persistence entry names, and pattern hashes.

3. Conclusion

The actual hazard of juannegro.solidity isn’t solely that TRAE did not synchronize the removing standing. It used the extension market because the preliminary supply channel, established persistent backdoors on Windows, macOS, and Linux, and obtained dynamically changeable C2 configurations by an Ethereum contract. The on-chain transactions on May 3 and May 16 display that the attacker continued updating the distant Shell and second-stage payload addresses even after the VSIX was revealed.

Extension market platforms shouldn’t solely synchronize publication info, but in addition synchronize threat assessments and removing statuses, whereas promptly notifying put in customers. Otherwise, the remediation already accomplished by Open VSX turns into ineffective on platforms like TRAE, and backdoors already implanted in techniques is not going to disappear resulting from market removing. They can proceed working independently of {the marketplace}.

About MistEye

MistEye is a Web3 menace intelligence and dynamic safety monitoring platform independently developed by SlowMist. Through its API, it gives malicious exercise detection and provide chain threat alerting capabilities for open-source bundle ecosystems.

All malicious packages and IOCs concerned in this operation have been built-in into the MistEye menace detection engine. Developers can use the API to routinely scan challenge dependencies, rapidly decide whether or not they match recognized malicious packages, and procure remediation suggestions.

📖 API Documentation: https://app.misteye.io/api-docs

🛠️ MistEye-DepScan: https://github.com/slowmist/MistEye-DepScan
A light-weight CLI device that scans challenge dependencies and globally put in packages for recognized malicious packages with a single command. It helps the npm, PyPI, Cargo, Go, and RubyGems ecosystems.

🛠️ MistEye-Skills: https://github.com/slowmist/misteye-skills
A safety talent bundle for AI coding assistants that routinely triggers MistEye safety checks earlier than dependency set up and URL entry.

About SlowMist

SlowMist is a menace intelligence agency targeted on blockchain safety, established in January 2018. The agency was began by a staff with over ten years of community safety expertise to change into a world pressure. Our purpose is to make the blockchain ecosystem as safe as attainable for everybody. We are actually a famend worldwide blockchain safety agency that has labored on varied well-known initiatives akin to HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, and many others.

SlowMist provides a number of companies that embody however should not restricted to safety audits, menace info, protection deployment, safety consultants, and different security-related companies. We additionally supply AML (Anti-money laundering) software program, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and different SaaS merchandise. We have partnerships with home and worldwide companies akin to Akamai, BitDefender, RC², TianJi Partners, IPIP, and many others. Our in depth work in cryptocurrency crime investigations has been cited by worldwide organizations and authorities our bodies, together with the United Nations Security Council and the United Nations Office on Drugs and Crime.

By delivering a complete safety resolution personalized to particular person initiatives, we are able to determine dangers and forestall them from occurring. Our staff was capable of finding and publish a number of high-risk blockchain safety flaws. By doing so, we may unfold consciousness and lift the safety requirements in the blockchain ecosystem.

Similar Posts