Fake Solidity interview repo sol-live hides VS Code terminal backdoor that steals wallet and browser data
SlowMist found that 'interview practice' GitHub repositories such as Hylance/sol-live hide malicious VS Code terminal profiles. These download and run an infostealer that targets wallet extensions, browser logins and the Keychain. Inspect .vscode/settings.json before opening a terminal, and hunt for the listed IOCs.
Vuln-watch · relayed from a public source; see Source & attribution below
Summary
SlowMist reports a GitHub repository named sol-live (Hylance/sol-live), presented as a Solidity interview practice project, whose hidden .vscode/settings.json defines malicious VS Code terminal profiles. Launching a terminal with the project's custom zsh/bash profile downloads and evals remote JavaScript. SlowMist's analysis of the roughly 4 MB obfuscated payload found modules for browser data theft, file scanning and upload, and remote control. SlowMist lists eight more related repositories.
Affected
- Developers who clone and open Hylance/sol-live or the related repositories listed by SlowMist in VS Code, then launch a terminal using the project-defined profile
- macOS and Linux: execution happens when the user picks the project's custom zsh/bash terminal profile. Windows: the profile is set as the default powershell terminal, but SlowMist could not confirm the chain works
- No fix applies (malicious content, not a software flaw)
Impact
Per SlowMist, the loader POSTs to https://www.enabledomain.app/api/ip-check-encrypted/3aeb34a36 and evals the response with the current user's privileges. The payload's code targets browser login databases, wallet extension storage, macOS Keychain files, local files and clipboard contents, and uploads to 172.86.112.107. The command is hidden behind hundreds of spaces and files.exclude hides the .vscode directory. Because of quoting, dropped files land in a literal "~/.vscode/cache" directory under the terminal's working directory (app.js), and lock files pid.2.1.lock to pid.2.3.lock go in the system temp directory. SlowMist analysed the sample statically and from retained responses. It notes that it did not observe these behaviours on victim hosts.
Recommended actions
- Review .vscode/settings.json (terminal profiles, defaultProfile, files.exclude) in any interview or practice project before opening a terminal in it
- Search hosts for a literal "~" directory containing .vscode/cache/app.js, for pid.2.x.lock files in the temp directory, and for Node.js connections to 172.86.112.107. Search DNS and proxy logs for the listed domains and URLs
- If execution can't be ruled out: isolate the host, move funds to new wallets created on a trusted device, revoke token approvals, and rotate browser passwords, exchange API keys, SSH keys, cloud credentials and Keychain secrets
- File hashes (per SlowMist): sol-live.zip SHA256 573c5060ec782e3ec43d8db7be5042c2ed384017f90c6392799429d88e964c7d (MD5 bb28e10c8d08cf302f0a51f8e3a2202c). enabledomain-post SHA256 79fca3decd09b7c86ffd4d05862e2ae76d0fbb90e705ff3f7ebf36f4c81ddd31
- Do not block github.com as a whole. The repository URLs are for locating and reporting the projects
Source & attribution
This 0xCERT advisory summarises a disclosure by the SlowMist Threat Intelligence team (MistEye): https://slowmist.medium.com/threat-intelligence-beware-web3-interview-questions-conceal-a-data-stealing-backdoor-615cebdcb21c. Details may change; refer to the original source for the authoritative record.
References
Indicators of compromise
All IOC feeds →- domaincodeprettier.proMalware delivery domain, fake-interview VS Code backdoor (per SlowMist)
- domainwww.configs.liveMalware delivery domain, fake-interview VS Code backdoor (per SlowMist)
- domainwww.enabledomain.appMalware delivery domain, fake-interview VS Code backdoor (per SlowMist)
- domainwww.tanxilabs.comMalware delivery domain, fake-interview VS Code backdoor (per SlowMist)
- urlhttp://172.86.112.107:8085/api/upload-fileData-exfiltration / C2 endpoint (per SlowMist)
- urlhttp://172.86.112.107:8085/uploadData-exfiltration / C2 endpoint (per SlowMist)
- urlhttp://172.86.112.107:8086/uploadData-exfiltration / C2 endpoint (per SlowMist)
- urlhttp://172.86.112.107:8087/api/logData-exfiltration / C2 endpoint (per SlowMist)
- urlhttp://172.86.112.107:8087/api/notifyData-exfiltration / C2 endpoint (per SlowMist)
- urlhttps://codeprettier.pro/settings/linux?flag=2Payload download URL, fake-interview VS Code backdoor (per SlowMist)
- urlhttps://codeprettier.pro/settings/linux?flag=6Payload download URL, fake-interview VS Code backdoor (per SlowMist)
- urlhttps://codeprettier.pro/settings/mac?flag=2Payload download URL, fake-interview VS Code backdoor (per SlowMist)
- urlhttps://codeprettier.pro/settings/mac?flag=6Payload download URL, fake-interview VS Code backdoor (per SlowMist)
- urlhttps://codeprettier.pro/settings/windows?flag=2Payload download URL, fake-interview VS Code backdoor (per SlowMist)
- urlhttps://codeprettier.pro/settings/windows?flag=6Payload download URL, fake-interview VS Code backdoor (per SlowMist)
- urlhttps://github.com/Echo-skill-ai/go-liveMalicious 'interview' repository with backdoored .vscode/settings.json (per SlowMist)
- urlhttps://github.com/Hylance/sol-liveMalicious 'interview' repository with backdoored .vscode/settings.json (per SlowMist)
- urlhttps://github.com/KchTT/javascipt-liveMalicious 'interview' repository with backdoored .vscode/settings.json (per SlowMist)
- urlhttps://github.com/Liao1/solidityMalicious 'interview' repository with backdoored .vscode/settings.json (per SlowMist)
- urlhttps://github.com/chicodias/python-liveMalicious 'interview' repository with backdoored .vscode/settings.json (per SlowMist)
- urlhttps://github.com/moyea/javascript-liveMalicious 'interview' repository with backdoored .vscode/settings.json (per SlowMist)
- urlhttps://github.com/pedromtcosta/tech-assignmentMalicious 'interview' repository with backdoored .vscode/settings.json (per SlowMist)
- urlhttps://github.com/stockx-fi/stockx_v1Malicious 'interview' repository with backdoored .vscode/settings.json (per SlowMist)
- urlhttps://github.com/zzz6519003/code-interview-jsMalicious 'interview' repository with backdoored .vscode/settings.json (per SlowMist)
- urlhttps://www.configs.live/settings/linux?flag=6Payload download URL, fake-interview VS Code backdoor (per SlowMist)
- urlhttps://www.configs.live/settings/linux?flag=8Payload download URL, fake-interview VS Code backdoor (per SlowMist)
- urlhttps://www.configs.live/settings/mac?flag=6Payload download URL, fake-interview VS Code backdoor (per SlowMist)
- urlhttps://www.configs.live/settings/mac?flag=8Payload download URL, fake-interview VS Code backdoor (per SlowMist)
- urlhttps://www.configs.live/settings/windows?flag=8Payload download URL, fake-interview VS Code backdoor (per SlowMist)
- urlhttps://www.enabledomain.app/api/ip-check-encrypted/3aeb34a30Payload download URL, fake-interview VS Code backdoor (per SlowMist)
- urlhttps://www.enabledomain.app/api/ip-check-encrypted/3aeb34a36Payload download URL, fake-interview VS Code backdoor (per SlowMist)
- urlhttps://www.tanxilabs.com/settings/linux?flag=3Payload download URL, fake-interview VS Code backdoor (per SlowMist)
- urlhttps://www.tanxilabs.com/settings/mac?flag=3Payload download URL, fake-interview VS Code backdoor (per SlowMist)
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-10-23 · last updated 2026-10-24
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0270/signed.txt | gpg --verify