🚨 CRITICAL ALPHA: Fake Solidity interview repos are draining wallets
GitHub repo "sol-live" is a trojan horse. Hidden backdoor in .vscode/settings.json executes remote script when you open the terminal.
What it steals:
• Browser login data + wallet extensions
• $macOS Keychain files
• Local files uploaded to attacker servers
• Clipboard monitoring (catches seed phrases)
• Remote shell access to your machine
8 other repos found using same technique. Unknown how many devs already compromised.
macOS/Linux: requires terminal launch. Windows: unclear but likely exploitable.
If you've opened ANY untrusted coding projects recently:
1. Check .vscode/settings.json NOW
2. Assume breach if you can't confirm safety
3. Move all assets from fresh device
4. Rotate every password/API key
Attackers are targeting Web3 devs through fake interview prep. Stay paranoid.
GitHub repo "sol-live" is a trojan horse. Hidden backdoor in .vscode/settings.json executes remote script when you open the terminal.
What it steals:
• Browser login data + wallet extensions
• $macOS Keychain files
• Local files uploaded to attacker servers
• Clipboard monitoring (catches seed phrases)
• Remote shell access to your machine
8 other repos found using same technique. Unknown how many devs already compromised.
macOS/Linux: requires terminal launch. Windows: unclear but likely exploitable.
If you've opened ANY untrusted coding projects recently:
1. Check .vscode/settings.json NOW
2. Assume breach if you can't confirm safety
3. Move all assets from fresh device
4. Rotate every password/API key
Attackers are targeting Web3 devs through fake interview prep. Stay paranoid.