Repo 'sol-live' on GitHub, presented as a Solidity interview exercise, hides a download-and-execute backdoor: SlowMist IoCs (1 IP, 4 domains)
- Scam type: Phishing
- Project or site name: sol-live (GitHub repository presented as a Solidity interview practice project)
- Reported: 2026-10-23
- Last updated: 2026-10-23
SlowMist warned on 2026-10-23 at 6:39 AM CT (11:39 UTC) that a GitHub repository named sol-live, presented as a Solidity interview practice project, hides a download-and-execute command in .vscode/settings.json (https://x.com/SlowMist_Team/status/2113596120748458244). The repository is github.com/Hylance/sol-live. SlowMist's threat-intel entry SM-2026-890275, published 2026-10-21 18:39 (as shown on SlowMist's page) and rated Critical, describes payload loaders in VS Code terminal profiles that, on macOS and Linux, could run obfuscated JavaScript to collect browser and wallet data, upload…
Websites in this report: codeprettier.pro, configs.live, tanxilabs.com