Odaily reports: Slow Mist has issued a security warning stating that it recently received user reports about a GitHub repository named sol-live, disguised as a Solidity interview practice project, that hides malicious code. Analysis shows that the project's .vscode/settings.json file contains commands to download and execute remote scripts, which can trigger malicious behavior when users launch the custom terminal configured by the project.

The malicious payload contains three main modules capable of collecting browser login databases and wallet extension storage data, copying macOS keychain files, scanning and uploading local files, and can also execute remote commands, provide interactive Shell access, and monitor clipboard contents. Slow Mist stated that on macOS and Linux systems, the attack requires users to actively launch the malicious terminal configuration; the attack chain on Windows systems has not yet been confirmed. Additionally, Slow Mist discovered 8 other GitHub projects using similar terminal download-and-execute techniques. Currently, the actual scope of infection and whether any data has been stolen cannot be confirmed. Slow Mist recommends that users check the relevant terminal configuration before using untrusted projects; if it cannot be ruled out that a device has been affected, the device should be isolated and investigated, and wallet assets should be migrated through a trusted device, along with rotating relevant credentials.