For emails, the email referenced in this post is now defunct. New emails should be addressed to: [email protected] Please refer to the post for the most up-to-date information: on.blockmage.dev/2023-04-25

We have updated our PGP keys. The key referenced in this post remains valid, but defunct UIDs have been removed. The article has been updated to reflect these changes. All keys have been cross-certified (the old with the new, and both with our new hardware master key).

Takeaway: Automated scanners are essential for flagging capabilities, but manual verification is the only way to determine intent. We acted quickly in hopes of preventing harms, but in this case, we were mistaken. We've removed the post to avoid any confusion (sorry!).

- The SOL wallet identified was actually a character property table in the Oniguruma regex engine. - The "Dropper" patterns were standard Emscripten/LLHTTP boilerplate. - The "Stealer" hits were bundled dotenv and undici dependencies.

Earlier today, we flagged a VS Code extension (rphlmr.vscode-drizzle-orm) based on 21 critical YARA hits from vsix-audit. After manual inspection and deeper analysis, inspecting the .vsix, and reversing the WASM binaries, we’ve confirmed this is a False Positive.