Odaily Planet Daily News: According to SlowMist monitoring, the malicious TRAE IDE extension juannegro.solidity disguises itself as a Solidity plugin and acts as a cross-platform malware dropper. The extension automatically executes upon IDE startup, establishes persistence, and uses Ethereum smart contracts to store and retrieve dynamic C2 configurations, allowing attackers to update C2 endpoints and payloads without needing to re-release the extension. Although the extension has been removed from Open VSX, as of July 18, it was still obtainable via the TRAE marketplace. Users who have installed it should immediately delete it and check their systems for compromise.