Malicious TRAE Extension juannegro.solidity Plants Onchain Backdoor with Dynamic C2 Configuration

According to SlowMist security team, a malicious extension named juannegro.solidity was found in the TRAE IDE marketplace, disguised as a legitimate Solidity plugin. Although removed from Open VSX, the extension remained accessible via TRAE marketplace as of July 18. SlowMist analysis shows the extension executes upon IDE startup, establishing persistence and using Ethereum smart contracts to store and retrieve dynamic C2 configurations, allowing attackers to update endpoints and payloads without republishing the extension.

Users who installed the extension are urged to remove it immediately and check for system compromise. The incident highlights extension marketplaces as initial infection vectors and blockchain infrastructure being exploited for dynamic C2 management.