A coding exercise can put wallet data at risk if its editor settings launch commands unrelated to the assignment. In an analysis published on October 23, 2026, at 18:20 (UTC+8), SlowMist described a GitHub repository, Hylance/sol-live, that presented itself as Solidity interview practice while concealing a remote-code execution chain in its VS Code terminal configuration.
For holders assessing possible exposure, the key distinction is whether the malicious terminal configuration actually ran. On macOS and Linux, simply opening this project was not the trigger identified in the report: users had to select and launch a project-defined terminal profile. The Windows configuration attempted a different route, but SlowMist could not confirm that it worked.
The analysis identified code capable of collecting wallet-extension storage, browser databases and local files, copying a macOS keychain file, monitoring the clipboard and executing remote commands. It did not establish actual infections, successful credential decryption, data exfiltration or asset losses.
How the interview exercise concealed execution
According to SlowMist, the repository’s README listed eight exercises, each advertised as taking five to ten minutes. Its .vscode/settings.json mixed ordinary editor preferences with malicious terminal profiles named after familiar shells: zsh, bash and PowerShell.
Hundreds of spaces made the download-and-execute commands less visible. A files.exclude rule also hid the .vscode directory from VS Code’s file tree. That rule did not delete the directory or prevent VS Code from reading its settings.
On macOS and Linux, launching the malicious profile would check for Node.js and npm. If necessary, the command would use the official nvm v0.40.3 installer and install Node.js LTS. It then installed axios, wrote a loader to app.js and ran it in the background with terminal output suppressed.
The loader sent a POST request without a request body to a fixed remote endpoint and passed the response directly to eval, without validating its contents. The chain ran with the current user’s privileges and did not require administrator authorization. The response retained for analysis contained approximately 4 MB of obfuscated JavaScript.
An important forensic detail is the quoted path "~/.vscode/cache". Because the tilde was inside double quotes, it was not expanded to the user’s home directory. The resulting location was ./~/.vscode/cache beneath the terminal’s starting working directory—typically the project directory—not necessarily the home-directory cache path a responder might expect.
Platform-specific limits
- macOS and Linux: The repository did not set these malicious profiles as defaults. A user had to select the project-defined zsh or bash profile and start a terminal.
- Windows: The repository set PowerShell as the default profile and attempted to launch a hidden PowerShell window. However, SlowMist found a quoting problem that could make the generated JavaScript invalid. The chain was not tested on Windows, so successful remote execution remained unconfirmed.
SlowMist also distinguished this mechanism from a separate VS Code proof of concept using .vscode/tasks.json. That technique associates an automatic task with runOn: folderOpen, subject to automatic-task approval. It should not be confused with the terminal-profile trigger found in sol-live.
What the retrieved payload could do
SlowMist based its findings on archived source code, retained HTTP responses and offline reconstruction. The team said it did not execute the malware, establish a command-and-control session or access the analysis host’s browser data, keychain or clipboard.
The reconstructed payload contained three main modules: browser-data collection, file scanning and uploading, and remote control. It could install missing JavaScript dependencies and launch the modules as detached Node.js processes with output suppressed.
The code recorded process IDs and start times in three files in the system temporary directory:
pid.2.1.lock— browser-data collectionpid.2.2.lock— file scanning and uploadingpid.2.3.lock— remote control
Background execution was not evidence of reboot persistence. SlowMist found no macOS startup service, Windows scheduled task or Linux cron mechanism in the analyzed code. Reusing the malicious terminal profile could, however, trigger execution again on macOS or Linux.
Browser and wallet data: collection is not decryption
The browser module contained path rules for 13 Chromium-based browsers and checked 41 hard-coded extension IDs, including those associated with MetaMask, Phantom, TronLink and Rabby. Its targets included browser login and autofill databases, wallet-extension local storage and Brave’s LevelDB storage. On macOS, it also attempted to copy ~/Library/Keychains/login.keychain-db.
These capabilities do not establish that readable secrets were obtained:
- The analyzed
decryptPassword()function immediately returned an empty string, leaving its subsequent AES-GCM and DPAPI decryption branches unreachable. The code could still extract URLs, usernames and encrypted password values, storing encrypted values as Base64 text. - Separate code attempted to obtain browser encryption keys through platform-specific mechanisms, but its effectiveness was not tested.
- Copying a wallet extension’s storage does not by itself prove access to its recovery phrase or private keys. Encryption depends on the extension’s implementation, and SlowMist did not verify decryption.
- Copying
login.keychain-dbdoes not provide plaintext keychain credentials. The file remains protected by the user’s login password; further access depends on the password or relevant system access.
The browser module was configured to upload collected files to 172[.]86[.]112[.]107:8085/upload. Its HMAC-SHA256 request authentication did not encrypt the contents: the upload used plaintext HTTP. The module was configured for up to 11 cycles, 30 seconds apart, querying databases every third cycle.
File uploads and remote access
The file scanner began approximately one second after startup, despite a comment describing a ten-minute delay. It prioritized locations such as Desktop, Documents, Downloads, cloud-drive folders, Projects, Development and Code.
In those priority locations, files up to 5 MiB could enter the upload queue without matching a sensitive keyword, provided their extensions were not excluded. Elsewhere under the home directory, paths had to match patterns covering items such as recovery phrases, private keys, wallets, .env files, configurations, databases, documents and screenshots. The code also included broader scanning paths for Windows and WSL.
The scanner excluded directories including .ssh, .aws, .gnupg, .kube and .config, but those exclusions applied only to that module. The remote-control module could still read specified files accessible to the running user.
The remote-control code supported directory listings, file uploads, arbitrary command execution and interactive terminal sessions. One directory-upload operation allowed individual files up to 25 MiB. Its clipboard logic attempted to read the clipboard every second and send changed, nonempty contents to the server. Cross-platform operation of these capabilities was not verified.
What potentially affected holders should check
SlowMist recommends prioritizing hosts where the malicious terminal profile was used, then assessing wallet credentials and browser-saved exchange credentials. Opening a repository and executing its malicious configuration should not be treated as equivalent evidence.
1. Isolate the host and preserve evidence
If execution is confirmed or cannot be ruled out, isolate the suspected machine and retain information needed for investigation before handling recovery from a trusted device.
For Hylance/sol-live, relevant checks include:
- Whether the project-defined zsh or bash profile was selected and launched.
- A literal
~directory under the project or terminal working directory, containing.vscode/cache/app.js. - The three
pid.2.*.lockfiles in the system temporary directory. - Node.js processes and connection records involving
172[.]86[.]112[.]107.
For related projects with Windows configurations, SlowMist recommends examining their actual commands before checking artifacts such as $PROFILE, %temp%\settings.cmd, Defender exclusions and malicious-domain connections. Indicators from different repositories should not be assumed to describe an identical execution chain.
2. Handle wallet recovery from a trusted device
Where malicious execution is confirmed or cannot be excluded, SlowMist recommends treating recovery phrases and private keys used or stored on the host as compromised, creating a new wallet on a trusted device and transferring assets. It also recommends reviewing the old addresses’ on-chain contract approvals and revoking unnecessary or risky approvals.
This is a precautionary response recommendation, not a finding that the analyzed malware successfully stole those secrets.
3. Rotate other exposed credentials
The report recommends rotating browser-account passwords, exchange API keys, SSH keys and cloud-service credentials stored or used on the affected host. File-scanner exclusions do not rule out access through the remote-control module.
For macOS, SlowMist also recommends changing the login password and rotating relevant passwords and keys stored in the keychain. Changing the login password does not invalidate an old keychain file that may already have been copied.
4. Review editor configuration before running an assignment
Before launching project-defined terminals, inspect .vscode/settings.json, including default profiles, custom terminal definitions and launch arguments. SlowMist highlights commands that download and immediately execute content, use nohup for background execution, write to $PROFILE or call eval.
A project that has no malicious default profile can still be dangerous if a user manually selects its malicious profile. Hidden .vscode settings combined with whitespace-padded or heavily escaped download-and-execute commands are a particularly important warning sign.
Related repositories and investigation indicators
SlowMist identified eight additional GitHub repositories containing similar terminal configurations that downloaded remote content and passed it to sh or eval. Those findings were limited to preliminary configuration checks; the team did not retrieve and deeply analyze every remote payload.
The repositories listed in the report were:
Hylance/sol-livezzz6519003/code-interview-jsLiao1/soliditystockx-fi/stockx_v1KchTT/javascipt-livechicodias/python-livemoyea/javascript-liveEcho-skill-ai/go-livepedromtcosta/tech-assignment
Reported network indicators included www[.]enabledomain[.]app, codeprettier[.]pro, www[.]configs[.]live, www[.]tanxilabs[.]com and 172[.]86[.]112[.]107, with upload and control services on ports 8085, 8086 and 8087.
The reported SHA-256 hashes were:
sol-live.zip:573c5060ec782e3ec43d8db7be5042c2ed384017f90c6392799429d88e964c7denabledomain-post:79fca3decd09b7c86ffd4d05862e2ae76d0fbb90e705ff3f7ebf36f4c81ddd31
The original report provides the full endpoint list for investigation. Repository references are intended for identification, evidence collection and platform reporting—not as a reason to block all of github.com.
The central custody lesson is to assess execution evidence and credential exposure separately. The code’s collection and remote-control capabilities justify careful incident response, but they do not establish that encrypted wallet data was decrypted or that funds were stolen.
Source: SlowMist’s original analysis, published October 23, 2026, at 18:20 (UTC+8).