SlowMist: GitHub Project Disguised as Solidity Interview Question Hides Backdoor, Can Steal Wallet Data and Execute Remote Commands

Odaily reports: SlowMist has issued a security alert stating that it recently received user reports about a GitHub repository named sol-live, disguised as a Solidity interview practice project, that harbors malicious code. Analysis revealed that the project's .vscode/settings.json file contains commands to download and execute remote scripts, which can trigger malicious behavior when users launch the custom terminal configured by the project.

The malicious payload contains three main modules capable of collecting browser login databases and wallet extension storage data, copying macOS Keychain files, scanning and uploading local files, as well as executing remote commands, providing interactive Shell access, and monitoring clipboard contents. SlowMist stated that on macOS and Linux systems, the attack requires users to actively launch the malicious terminal configuration; the attack chain on Windows systems has not yet been confirmed. Additionally, SlowMist discovered 8 other GitHub projects using similar terminal download-and-execute techniques. The actual scope of infection and whether any data has been stolen remain unconfirmed. SlowMist recommends that users check relevant terminal configurations before using untrusted projects; if it cannot be ruled out that a device has been affected, the device should be isolated and investigated, wallet assets should be migrated via a trusted device, and relevant credentials should be rotated.