On October 23, Slow Mist publicly issued a security alert regarding the GitHub repository sol-live based on abnormal feedback from real users in development scenarios. On the surface, this appears to be a "Solidity interview and practice project" that many developers might clone and open directly on their local machines while preparing for job applications or taking supplementary lessons. However, Slow Mist's technical analysis pointed out that the core of the attack does not lie within the visible source code, but is hidden in the project's .vscode/settings.json file—a segment of custom terminal configuration that silently downloads and executes remote scripts when developers start the VSCode terminal, turning a routine development process into a covert supply chain attack entry point. Subsequent analysis showed that this malicious payload is not a simple trojan; it can collect browser login databases and wallet extension storage data, copy macOS keychain files, and scan and upload local files, all while adapting specifically to data types such as browser wallets, mnemonic phrases, and account credentials. This specifically targets developers who are accustomed to debugging contracts and installing various wallet extensions on their personal computers, potentially leading to the unintentional exposure of their entire set of sensitive assets and identity information.
sol-live Interview Repository Laying Traps for Developers
On the surface, sol-live is virtually indistinguishable from common Solidity interview practice repositories: the repository name directly indicates its purpose, and the description revolves around "Solidity learning" and "interview projects", aligning with practice scenarios frequently used by contract developers preparing for job applications. For many who search for interview questions on GitHub and follow example projects to code, such a repository looks like a ready-made question bank and template project, naturally carrying a trustworthy label of "community open-source resources". Slow Mist clearly pointed out in the security alert on October 23 that sol-live is not merely a collection of interview practice questions, but a carefully disguised malicious project; this conclusion comes from real user feedback after experiencing abnormalities while using the repository in development scenarios, rather than theoretical deductions in a lab setting.
The job preparation and learning scenarios themselves provide an ideal entry point for attackers. In this context, developers prioritize quickly completing questions and getting contracts running, rather than reviewing every configuration file in the project line by line; many will browse contract code and test cases, but seldom think to check auxiliary configurations like .vscode/settings.json, considering them as default safe "development environment noise". Sol-live exploits this psychology by hiding malicious terminal configurations in the least noticeable location, thus extending the attack surface to the developer's local environment. After Slow Mist revealed the incident and the security community spread the news, an unconventional risk was brought to light: a repository that appears to be the most "legitimate" for interview questions can also be used as a vehicle for supply chain attacks. Every pull of practice projects by developers during their job search and learning process can no longer be casually viewed as zero-risk operations.
VSCode Configuration as an Attack Entry
Slow Mist's analysis revealed that the real "switch" of sol-live is not located in any Solidity source file, but rather buried within the project root directory under `.vscode/settings.json`. Attackers utilize VSCode's terminal custom configuration fields to pre-write a set of seemingly normal terminal presets, and once developers start the integrated terminal in that project and use these presets, VSCode will automatically execute specified commands according to the configuration, downloading and running malicious scripts from a remote server. In other words, developers believe they are merely opening a terminal window for running tests and writing interview questions, but in reality, they are pressing the start button for remote control scripts right on their local machine. This technique is classified by Slow Mist as a typical case of "development environment poisoning" styled supply chain attack.
This also strikes at the security blind spots of most developers: people are accustomed to reviewing business source code in repositories, worrying about vulnerabilities in contract logic or backdoors in dependency packages, yet seldom view editor configurations and terminal presets as potential execution entry points. When faced with a repository that claims to be for "interview practice," many will directly accept the accompanying VSCode configuration, even considering it a thoughtful enhancement to their development experience, without realizing that this precisely circumvents security reviews of the source code. The core issue exposed by the sol-live event is the risk of only viewing code without scrutinizing the development environment itself: as long as a local IDE can be configured to automatically pull and execute remote commands, any overlooked configuration file may become the first door for attackers to enter your machine.
Wallet Data and Keychains as Targets
Once the VSCode terminal is quietly connected to a remote script, subsequent malicious payloads begin systematically scavenging sensitive information. The first module directly targets the browser's login database and storage data of various wallet extensions, which is often where many developers conveniently check the "remember me" option and remain logged in to their wallets. The browser's login database often contains login credentials like email addresses and platform accounts, while wallet extensions store key derivation information, address lists, and authorization statuses. For those working with crypto assets, this data encompasses nearly all entry points to their work; if copied to the attacker's side, long-unchanged passwords, backend system accounts, and control over frequently used wallets may be exposed without any awareness.
The second module goes a step further, directly copying macOS keychain files, creating conditions for further cracking and extracting local credentials and keys. The keychain is a system-level password vault, which may simultaneously contain a developer's SSH keys, server login information, access tokens for various applications, and even some wallet-related key materials. Attackers only need to obtain the original files to have the opportunity to slowly dismantle them in an offline environment. The third module is responsible for broadly scanning local files to upload selected content to a remote host, which means that items such as locally backed-up mnemonic phrase texts, exported private key files, hard-coded access keys in configurations, and production environment configurations embedded in projects could all be packaged and taken in a single scan. More dangerously, the payload also possesses the ability to execute remote commands on the victim's machine, provide interactive Shell access, and monitor clipboard contents. Attackers can continuously stay on the developer's computer, dynamically adjust stealing strategies, and intercept sensitive snippets from copy operations in real time, leading developers to lose active control over their local and wallet data for an extended period simply due to trusting a "practice repository."
8 Similar Projects Expose a Broader Attack Surface
After analyzing sol-live, Slow Mist's threat intelligence did not stop at a single case but continued to track similar technical features. The result is that they identified 8 additional malicious projects on GitHub that closely resemble the methods and positioning of sol-live—also disguised as interview practice or development support repositories, similarly embedding remote script entry points in seemingly inconspicuous configurations. This indicates that sol-live is not an isolated accidental victim, but rather a proven attack path replicated under multiple different project shells, potentially casting a wider net over the same group of developers and crypto practitioners.
What is even more concerning is that the existence of these 8 projects broadens the potential range of affected individuals from "a few users who have used sol-live" to "an entire category of technical groups accustomed to pulling interview questions and practice projects from GitHub." Currently, publicly available materials do not provide specific names or repository addresses for these projects, nor have they disclosed evidence of actual asset losses or platform removals, leaving outsiders unable to gauge the status of the attack or how many individuals have fallen victim to it. Therefore, this batch of "similar projects" resembles a risk list illuminated by the security team, reminding developers that as long as attackers continue to utilize this model, any seemingly normal practice repository could quietly be replaced with new entry points someday, and the risk still needs to be clarified through ongoing investigations and public disclosures.
A Shift from Trusting Open Source to Scrutinizing the Environment
The sol-live incident forces developers to confront an uncomfortable reality: even when merely brushing through interview questions or engaging in learning exercises, they can no longer view "open source" as a natural safety endorsement. This time, attackers chose to bury malicious logic in `.vscode/settings.json`, using the interview repository as an entry point, prioritizing developers exposed to crypto assets, with browser wallet data, mnemonic phrases, and account credentials all within the attack range. This indicates that simply focusing on lines of source code is no longer sufficient; the real danger often lies hidden in configuration files that one thinks do not need to be examined. Returning to personal practices, going forward, when using third-party repositories, developers should at least deliberately check: whether the local development environment has been modified to change default terminals or script execution paths; whether there are commands pointing to unfamiliar remote servers; what exactly one-click install scripts do in the system; and try to isolate wallet plugins and sensitive credentials on everyday machines to avoid sharing the same environment for "coding" and "managing assets". The disclosure of sol-live stemmed from real user feedback about abnormalities in development scenarios and was given systematic analysis by Slow Mist on October 23, further uncovering 8 similar malicious projects. This entire chain of events serves as a signal: the likelihood of development environment poisoning and wallet data attacks resurfacing is high. Only through the formation of a continuous collaborative and public disclosure mechanism between security teams and developer communities can threats be preemptively intercepted before what seems like an ordinary practice repository turns into a trap.
Join our community, let’s discuss together, and become stronger together!
Exclusive Hyperliquid benefits for AiCoin: https://app.hyperliquid.xyz/join/AICOIN88
Exclusive Aster benefits for AiCoin: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
On-chain Twitter for AiCoin: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
