Came across a threat alert from SlowMist: there’s a GitHub repository called sol-live, presented as Solidity interview practice, but its .vscode/settings.json hides a backdoor that downloads and executes remote scripts.
Key details: simply opening the project’s custom terminal configuration could trigger it. The payload can collect browser login databases, wallet extension storage, and macOS Keychain data; scan local files; remotely control the machine; and monitor the clipboard. On macOS/Linux, the user must actively launch the malicious terminal configuration. The Windows attack chain is still unconfirmed due to a quoting issue. SlowMist also found 8 other repositories using similar techniques. The extent of infections and whether any data has been leaked have not yet been confirmed, according to the official statement.
Interview practice repositories can steal your wallet—before opening an unfamiliar GitHub project, should you take a peek at .vscode/settings.json?
#安全 #钓鱼 #Web3
Key details: simply opening the project’s custom terminal configuration could trigger it. The payload can collect browser login databases, wallet extension storage, and macOS Keychain data; scan local files; remotely control the machine; and monitor the clipboard. On macOS/Linux, the user must actively launch the malicious terminal configuration. The Windows attack chain is still unconfirmed due to a quoting issue. SlowMist also found 8 other repositories using similar techniques. The extent of infections and whether any data has been leaked have not yet been confirmed, according to the official statement.
Interview practice repositories can steal your wallet—before opening an unfamiliar GitHub project, should you take a peek at .vscode/settings.json?
#安全 #钓鱼 #Web3