[A researcher's computer was almost hacked, SlowMist Cosine said that this operation was a supply chain net attack on Solidity smart contract developers] Mars Finance News, crypto researcher @LehmannLorenz said on the X platform that his computer was almost hacked, and a malicious extension would be installed with just one click. The developer behind the extension is unverified, but it received 1.7 million downloads (more than any other extension) and a perfect 5/5 star rating within a day of its release. After downloading the malicious extension and extracting its contents, everything looks normal - except for the obfuscated "extension.js" file that runs when it is installed. The log file shows that the script eventually fails, and the attack relies on PowerShell execution, runs completely in memory, and does not leave any traces on disk.
In this regard, SlowMist Yuxian said that this is a supply chain attack on Solidity smart contract developers. The editor environment is a high-risk area for supply chain attacks. I have always tried to isolate what can be used in isolation, and try not to install what can be installed, to ensure the principle of "enough is enough". All the fancy things are thrown into independent computers or virtual machines.
