SlowMist Warns of Malicious GitHub Crypto Repos
Security researchers identified nine repositories targeting user wallets and browser data through VS Code configurations.
Updated on Oct. 24, 2026 in Cybersecurity
Live Poll
Do you trust the security of third-party open-source code repositories for your development work?
Security firm SlowMist has discovered a malicious GitHub repository called sol-live that is designed to steal sensitive cryptocurrency wallet data. The project deceptively markets itself as a tool for practicing Solidity interview questions to compromise unsuspecting developers.
Why it matters
The attack represents a significant threat to software developers by weaponizing common workspace configuration files to gain unauthorized access to credentials. By targeting development environments, malicious actors can exploit the trust developers place in open-source projects.
The malware operates via concealed commands within the .vscode/settings.json file, enabling clipboard monitoring, remote command execution, and file uploads. The threat specifically targets macOS and Linux users, with Windows vectors remaining unconfirmed.
The players
SlowMist
SlowMist is a specialized security firm that focuses on blockchain ecosystem protection and threat intelligence.
GitHub
GitHub is the widely used cloud-based platform where the malicious project repositories were hosted.
The details
The malicious code executes when a user initiates a specific terminal configuration within the compromised project. Once triggered, the malware attempts to capture browser login information, macOS Keychain files, and data from wallet extensions.
Timeline
October 24, 2026: SlowMist issued the public warning regarding the malicious repository.
The Tech Race
This incident follows a pattern set by the 2026 malicious GitHub repository campaign by demonstrating how attackers continue to weaponize open-source platforms to distribute malware. It underscores a shift where development environments have become high-value targets for credential harvesting.
Users should exercise extreme caution when cloning unknown projects and always inspect .vscode configuration files for obfuscated commands before running them. Developers are advised to prioritize security audits for any third-party code they intend to execute on their machines.
The takeaway
Developers should treat all downloaded repository settings files as potential vectors for malware, regardless of the perceived utility of the project. Always maintain the principle of least privilege by running untrusted code within isolated virtualized environments.
Further reading
For broader trends regarding software vulnerabilities, see our latest coverage on Cybersecurity.
Source note: This article includes information reported by TokenPost.
Live Poll
Do you trust the security of third-party open-source code repositories for your development work?
