SlowMist said a hidden command in sol-live’s VS Code workspace settings runs when a user starts the project’s configured terminal, potentially exposing developers’ sensitive data.
The command is in .vscode/settings.json, the firm said. SlowMist described risk on macOS and Linux but had not confirmed a Windows method. The project describes its purpose as helping users prepare for Solidity interviews.
Potential targets include browser login data saved by users, records held by wallet extensions and files in macOS Keychain. The malware may monitor clipboard contents, transfer files from the machine and allow remote command execution. The firm said it found related techniques in eight other GitHub repositories.
SlowMist did not specify the number of infections and did not confirm whether data had been exfiltrated.
For projects they do not trust, SlowMist said developers should examine VS Code workspace settings and terminal startup arguments. For a suspected run, SlowMist advised changing related credentials and moving wallet assets using a trusted device; it also recommended isolating the computer.
