SlowMist Discovers Data-Stealing Backdoor in Solidity Interview Project on GitHub

SlowMist has issued a threat intelligence alert stating that, following user reports, a GitHub repository named "sol-live" is masquerading as a Solidity interview practice project. However, its .vscode/settings.json file contains hidden commands designed to download and execute remote scripts; triggering the project’s custom terminal configuration may activate the malicious payload. SlowMist analysis reveals that the malicious payload can harvest browser login databases, wallet extension storage, and macOS Keychain files, as well as scan and upload local files, execute remote commands, provide interactive shell access, and monitor the clipboard. On macOS and Linux systems, the payload only executes if the user actively initiates the malicious terminal configuration; the attack chain on Windows remains unconfirmed due to issues with quote handling.