Glassworm's blockchain command channel went down. Nobody will say who pulled the plug.

The Glassworm botnet, a supply-chain worm hitting developers through poisoned npm and VS Code extensions, has lost its command-and-control infrastructure. Researchers at Koi Security say the operation has been disrupted after they neutralised C2 channels that piggybacked on Solana blockchain transactions and the BitTorrent Mainline DHT, two layers that were meant to make the botnet effectively unkillable.

That is the headline. The mechanics are thinner.

Koi's public statement describes the disruption as the result of "coordinated action" with unnamed partners. I asked the company three times to identify those partners, whether any law enforcement body was involved, and whether a court order or a private sinkholing arrangement underpinned the takedown. Koi declined to specify, citing operational sensitivity. (The company has not responded to a follow-up email sent the same afternoon.)

This matters because the Solana piece is the interesting part. Glassworm encoded C2 pointers inside on-chain transactions, which cannot be deleted. The infrastructure was not seized in the traditional sense. Something else happened. Either the attacker-controlled wallets were drained or frozen, or the resolver logic on infected hosts was redirected, or the bootstrap addresses on the DHT side were poisoned faster than the operators could refresh them. Koi's writeup gestures at all three without committing to any.

Glassworm first surfaced in October, when malicious versions of extensions including the ahban.shiba and ahban.cychelloworld packages were caught exfiltrating developer credentials and pivoting into CI pipelines. The worm's self-propagation relied on stolen npm tokens to publish further infected releases. Estimates of compromised developer machines vary widely. Koi puts the figure in the "low thousands." GitHub, which hosts the npm registry, has not published its own count. A spokesperson for GitHub said the platform had "taken action against malicious packages identified by external researchers" but would not confirm how many accounts were suspended or whether any belonged to legitimate maintainers whose tokens were stolen.

Neither Solana Foundation nor the BitTorrent project responded to requests for comment on whether they were notified before the disruption or asked to assist.

And here is the part that should worry anyone running a software supply chain: the operators are presumed to still hold the private keys. The on-chain pointers are inert because the resolver is broken, not because the attacker is gone. A second-stage version of the same worm, pointing at fresh wallets, would cost roughly the price of gas to deploy.

Koi told me the investigation is ongoing. I asked when a full technical writeup, including the takedown methodology, would be published. No date was given.

So the botnet is down. For now. The question nobody at Koi, GitHub, or Solana would answer on the record is what stops version two from booting tomorrow.