I don't clone a crypto repo without reading its config first anymore, and today's SlowMist warning is exactly why.
SlowMist flagged malicious GitHub repos today — one called sol-live, dressed up as a Solidity interview-practice tool — that hide commands in the project's .vscode/settings.json file. Once triggered, that hidden code can watch your clipboard, run remote commands, upload files, and go after browser logins, macOS Keychain data and wallet-extension data. It targets macOS and Linux users, and it's aimed squarely at developers, not random traders.
Here's my take: this is the part of crypto security nobody talks about enough. We obsess over seed phrases and phishing links, then happily clone a stranger's repo and let its workspace settings run on our machine. A repo is code execution, full stop — especially anything that asks you to run a terminal setup step. If you build in crypto, that settings file deserves the same suspicion as a wallet connection prompt.
My rule now: read .vscode/settings.json before I trust a repo, never run its setup on a machine that holds real wallets, and keep dev work and trading on separate machines where I can. The interview-practice disguise is what makes this one nasty — it targets people trying to learn, not people being greedy.
Do you actually check a repo's config files before cloning, or am I the paranoid one here?
SlowMist flagged malicious GitHub repos today — one called sol-live, dressed up as a Solidity interview-practice tool — that hide commands in the project's .vscode/settings.json file. Once triggered, that hidden code can watch your clipboard, run remote commands, upload files, and go after browser logins, macOS Keychain data and wallet-extension data. It targets macOS and Linux users, and it's aimed squarely at developers, not random traders.
Here's my take: this is the part of crypto security nobody talks about enough. We obsess over seed phrases and phishing links, then happily clone a stranger's repo and let its workspace settings run on our machine. A repo is code execution, full stop — especially anything that asks you to run a terminal setup step. If you build in crypto, that settings file deserves the same suspicion as a wallet connection prompt.
My rule now: read .vscode/settings.json before I trust a repo, never run its setup on a machine that holds real wallets, and keep dev work and trading on separate machines where I can. The interview-practice disguise is what makes this one nasty — it targets people trying to learn, not people being greedy.
Do you actually check a repo's config files before cloning, or am I the paranoid one here?