Malicious GitHub Repository Targets Crypto Wallet Data
The hidden code within workspace settings risks exposing browser logins and wallet credentials for macOS and Linux users.
Updated on Oct. 24, 2026 in Cybersecurity
Live Poll
Do you trust the security of third-party open-source code repositories for your development work?
Security firm SlowMist has identified a GitHub repository, sol-live, that contains malicious code designed to steal sensitive crypto wallet data. The project, which masquerades as a Solidity interview-practice resource, targets users on macOS and Linux systems.
Why it matters
This incident highlights a growing supply chain risk where attackers hide malicious commands within common developer workspace configuration files. By compromising trust in legitimate-looking code repositories, attackers can gain unauthorized access to browser data and wallet credentials.
The attack executes via a hidden command within a .vscode/settings.json file, triggering malware upon opening a terminal in the project. This payload enables clipboard monitoring, remote command execution, and unauthorized local file uploads.
The players
SlowMist
A blockchain security firm that specializes in threat intelligence, ecosystem monitoring, and smart contract auditing.
GitHub
The Microsoft-owned platform providing hosting for software development, version control, and collaboration tools.
The details
The attack relies on manipulating VS Code workspace settings, a feature used to customize environments for specific projects. When a user manually initiates a terminal in the compromised repository, the concealed commands execute, allowing the malware to scrape macOS Keychain files, browser logins, and wallet-extension data. The risk currently impacts users on macOS and Linux operating systems, though a Windows-specific vector remains unverified.
Timeline
October 24, 2026: SlowMist issued the warning regarding the malicious repository.
The Tech Race
This development follows a pattern set by the 2020 SolarWinds supply chain attack, demonstrating that attackers increasingly target the development environment itself to compromise end-user data. It emphasizes the ongoing struggle between platform providers attempting to sanitize shared repositories and threat actors leveraging legitimate configuration features.
Developers and crypto users on macOS and Linux should audit their workspace settings and avoid running terminal commands from untrusted repositories. There is currently no known remediation for users who may have already opened these specific projects beyond standard system credential rotation.
The takeaway
This discovery serves as a reminder to verify workspace configurations in unfamiliar code projects before launching terminal sessions. Monitor the SlowMist security feed for further identification of similar malicious repository patterns as they emerge.
Further reading
For more on the current state of software supply chain security, explore our Cybersecurity section.
Source note: This article includes information reported by TokenPost.
Live Poll
Do you trust the security of third-party open-source code repositories for your development work?
