SlowMist exposes GitHub malicious project: disguising Solidity interview questions, hiding data theft backdoors SlowMist has issued a security alert stating that it has recently received user reports that a GitHub repository named sol live, disguised as a Solidity interview practice project, is hiding malicious code. The malicious payload includes three main modules, which can collect browser login database and wallet extension storage data, copy macOS keychain files, scan and upload local files, execute remote commands, provide interactive shell access, and monitor clipboard content. SlowMist indicates that on macOS and Linux systems, attacks require users to actively launch malicious terminal configurations; The attack chain of Windows system has not been confirmed yet. In addition, SlowMist also discovered that 8 other GitHub projects used similar terminal download execution methods.