For emails, the email referenced in this post is now defunct. New emails should be addressed to: contact@blockmage.dev Please refer to the post for the most up-to-date information: on.blockmage.dev/2023-04-25

We have updated our PGP keys. The key referenced in this post remains valid, but defunct UIDs have been removed. The article has been updated to reflect these changes. All keys have been cross-certified (the old with the new, and both with our new hardware master key).

Takeaway: Automated scanners are essential for flagging capabilities, but manual verification is the only way to determine intent. We acted quickly in hopes of preventing harms, but in this case, we were mistaken. We've removed the post to avoid any confusion (sorry!).

- The SOL wallet identified was actually a character property table in the Oniguruma regex engine. - The "Dropper" patterns were standard Emscripten/LLHTTP boilerplate. - The "Stealer" hits were bundled dotenv and undici dependencies.

Earlier today, we flagged a VS Code extension (rphlmr.vscode-drizzle-orm) based on 21 critical YARA hits from vsix-audit. After manual inspection and deeper analysis, inspecting the .vsix, and reversing the WASM binaries, we’ve confirmed this is a False Positive.

How else would we know what they are up to all the time?

Unfortunate but true, web3 sees security as something you pay for once prior to your contract deployment. Brand protection gets sidelined in favor of keeping hype perpetually alive. Not to mention, those who do help, very often get nothing in return, so there's little incentive for professionals, albeit rife with opportunity to improve security across the board. We hardly have a name for the position though, so it can certainly be and feel overwhelming. That said, its always appreciable seeing the builders and the devs and security techs that are here, reaching out and making such efforts. This has been a constant in the space for years despite any market or trends otherwise. There's a sense of purpose to the whole thing because of this, and it certainly brings a level of quality and enthusiasm that you can't rightly find elsewhere. Nice post - cheers.