đ¨ CRITICAL ALPHA: Fake Solidity interview repos are draining wallets
GitHub repo "sol-live" is a trojan horse. Hidden backdoor in .vscode/settings.json executes remote script when you open the terminal.
What it steals:
⢠Browser login data + wallet extensions
⢠$macOS Keychain files
⢠Local files uploaded to attacker servers
⢠Clipboard monitoring (catches seed phrases)
⢠Remote shell access to your machine
8 other repos found using same technique. Unknown how many devs already compromised.
macOS/Linux: requires terminal launch. Windows: unclear but likely exploitable.
If you've opened ANY untrusted coding projects recently:
1. Check .vscode/settings.json NOW
2. Assume breach if you can't confirm safety
3. Move all assets from fresh device
4. Rotate every password/API key
Attackers are targeting Web3 devs through fake interview prep. Stay paranoid.
GitHub repo "sol-live" is a trojan horse. Hidden backdoor in .vscode/settings.json executes remote script when you open the terminal.
What it steals:
⢠Browser login data + wallet extensions
⢠$macOS Keychain files
⢠Local files uploaded to attacker servers
⢠Clipboard monitoring (catches seed phrases)
⢠Remote shell access to your machine
8 other repos found using same technique. Unknown how many devs already compromised.
macOS/Linux: requires terminal launch. Windows: unclear but likely exploitable.
If you've opened ANY untrusted coding projects recently:
1. Check .vscode/settings.json NOW
2. Assume breach if you can't confirm safety
3. Move all assets from fresh device
4. Rotate every password/API key
Attackers are targeting Web3 devs through fake interview prep. Stay paranoid.