-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0270 ============================================================ Advisory-ID: 0xCERT-2026-0270 Severity: High Published: 2026-10-23T10:39:30.000Z Updated: 2026-10-24T08:42:11.893Z Chains: n/a URL: https://www.0xcert.com/advisory/0xCERT-2026-0270 Title: Fake Solidity interview repo sol-live hides VS Code terminal backdoor that steals wallet and browser data Summary - ------- SlowMist found that 'interview practice' GitHub repositories such as Hylance/sol-live hide malicious VS Code terminal profiles. These download and run an infostealer that targets wallet extensions, browser logins and the Keychain. Inspect .vscode/settings.json before opening a terminal, and hunt for the listed IOCs. Details - ------- Summary SlowMist reports a GitHub repository named sol-live (Hylance/sol-live), presented as a Solidity interview practice project, whose hidden .vscode/settings.json defines malicious VS Code terminal profiles. Launching a terminal with the project's custom zsh/bash profile downloads and evals remote JavaScript. SlowMist's analysis of the roughly 4 MB obfuscated payload found modules for browser data theft, file scanning and upload, and remote control. SlowMist lists eight more related repositories. Affected - - Developers who clone and open Hylance/sol-live or the related repositories listed by SlowMist in VS Code, then launch a terminal using the project-defined profile - - macOS and Linux: execution happens when the user picks the project's custom zsh/bash terminal profile. Windows: the profile is set as the default powershell terminal, but SlowMist could not confirm the chain works - - No fix applies (malicious content, not a software flaw) Impact Per SlowMist, the loader POSTs to https://www.enabledomain.app/api/ip-check-encrypted/3aeb34a36 and evals the response with the current user's privileges. The payload's code targets browser login databases, wallet extension storage, macOS Keychain files, local files and clipboard contents, and uploads to 172.86.112.107. The command is hidden behind hundreds of spaces and files.exclude hides the .vscode directory. Because of quoting, dropped files land in a literal "~/.vscode/cache" directory under the terminal's working directory (app.js), and lock files pid.2.1.lock to pid.2.3.lock go in the system temp directory. SlowMist analysed the sample statically and from retained responses. It notes that it did not observe these behaviours on victim hosts. Recommended actions - - Review .vscode/settings.json (terminal profiles, defaultProfile, files.exclude) in any interview or practice project before opening a terminal in it - - Search hosts for a literal "~" directory containing .vscode/cache/app.js, for pid.2.x.lock files in the temp directory, and for Node.js connections to 172.86.112.107. Search DNS and proxy logs for the listed domains and URLs - - If execution can't be ruled out: isolate the host, move funds to new wallets created on a trusted device, revoke token approvals, and rotate browser passwords, exchange API keys, SSH keys, cloud credentials and Keychain secrets - - File hashes (per SlowMist): sol-live.zip SHA256 573c5060ec782e3ec43d8db7be5042c2ed384017f90c6392799429d88e964c7d (MD5 bb28e10c8d08cf302f0a51f8e3a2202c). enabledomain-post SHA256 79fca3decd09b7c86ffd4d05862e2ae76d0fbb90e705ff3f7ebf36f4c81ddd31 - - Do not block github.com as a whole. The repository URLs are for locating and reporting the projects Source & attribution This 0xCERT advisory summarises a disclosure by the SlowMist Threat Intelligence team (MistEye): https://slowmist.medium.com/threat-intelligence-beware-web3-interview-questions-conceal-a-data-stealing-backdoor-615cebdcb21c. Details may change; refer to the original source for the authoritative record. References - ---------- - - https://slowmist.medium.com/threat-intelligence-beware-web3-interview-questions-conceal-a-data-stealing-backdoor-615cebdcb21c - - https://github.com/Hylance/sol-live Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmrcjDUJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmfxcTrdES7w2CAoSct+l5YQ2VzyPL3WLRNwm+4k TAxjBhYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAgdwD7BTvlZUDnovT3Hn3i bIGhCx0GzLuqjMdxJ2IR19wmvb0A/0fN3G6blx/AEkL0ArjtMlrKBeP4PelW usb8M7ZxYfsG =czL4 -----END PGP SIGNATURE-----