A Solidity interview exercise can carry risks outside its smart-contract code. In a report published on October 23, 2026, at 18:20 UTC+8, SlowMist described how the GitHub repository Hylance/sol-live concealed download-and-execute commands in VS Code workspace settings.
The repository advertised eight exercises, each estimated to take 5–10 minutes. According to SlowMist, its .vscode/settings.json also contained malicious terminal profiles, with hundreds of spaces placed before commands to make them less visible. A files.exclude rule hid the .vscode directory from VS Code’s file tree without preventing the editor from reading its settings.
Opening the project and triggering its malicious terminal configuration are not the same event. On macOS and Linux, the analyzed execution chain required a user to select and launch the project-defined zsh or bash profile. Windows execution remained unconfirmed.
What the analysis established—and what it did not
SlowMist based its findings on archived source code, retained HTTP responses and scripts reconstructed offline. The team said it did not execute the malware, establish a command-and-control session, or access the analysis host’s browser data, keychain or clipboard.
The findings therefore describe capabilities present in the code, not confirmed activity on victims’ computers. SlowMist could not establish the infection scope, successful credential decryption or actual data exfiltration.
How the terminal configuration led to remote code execution
The workspace settings mixed ordinary editor preferences with terminal profiles for macOS, Linux and Windows. The profiles used familiar shell names, making them easier to mistake for normal configurations.
For macOS and Linux, the commands checked for Node.js and npm. If either check failed, the chain used the official nvm-sh/nvm v0.40.3 installer, loaded nvm and installed Node.js LTS. It then installed axios, wrote an app.js loader and ran it.
That loader sent a POST request without a request body to a fixed remote endpoint, then passed the response directly to eval without validating it. SlowMist retained an approximately 4 MB obfuscated JavaScript response. The surrounding commands used nohup, output redirection and background execution to reduce visible output. The chain ran with the current user’s permissions and did not require administrator authorization.
A path detail matters when checking for artifacts: the commands used the quoted string "~/.vscode/cache". Because the tilde was quoted, it did not expand to the user’s home directory. The resulting path was ./~/.vscode/cache under the terminal’s starting working directory—typically the project directory—not necessarily ~/.vscode/cache in the home directory.
Platform-specific limits
- macOS and Linux: The project did not set these malicious profiles as the default. A user had to select and launch the project-defined profile.
- Windows: The project set PowerShell as the default profile and attempted to launch a hidden PowerShell window. However, SlowMist found quoting that could leave invalid JavaScript in
app.js. The team did not test the chain on Windows, so successful remote execution was not confirmed.
SlowMist also distinguished this technique from its founder Cos’s separate vscode_tasks_command_execute_poc: that proof of concept uses .vscode/tasks.json and an automatic task associated with runOn: folderOpen, subject to permission to run automatic tasks. It has different trigger conditions from the terminal-profile mechanism analyzed here.
What the downloaded code could collect
The reconstructed payload could launch three detached Node.js processes: a browser-data collector, a file scanner/uploader and a remote-control module.
Browser and wallet-extension storage
The browser module contained path rules for 13 Chromium-based browsers and checked local-storage directories for 41 hard-coded extension IDs, including MetaMask, Phantom, TronLink and Rabby. Its targets included browser login and autofill databases, wallet-extension storage, Brave LevelDB data and, on macOS, ~/Library/Keychains/login.keychain-db.
However, the analyzed decryptPassword() function immediately returned an empty string, making its later decryption branches unreachable. The code could still extract URLs, usernames and encrypted password values, storing the latter as Base64 text.
Copying wallet-extension storage or a keychain file does not establish that seed phrases, private keys or plaintext passwords were recovered. SlowMist did not verify whether the collected wallet data could be decrypted. A copied macOS login keychain remained protected by the user’s login password.
Local files
The file scanner began approximately one second after startup, despite a code comment saying “10 minutes.” It prioritized locations such as Desktop, Documents, Downloads, cloud-storage folders, Projects, Development and Code.
In those priority locations, files could enter the upload queue without matching a sensitive keyword, provided they were not excluded by extension and were no larger than 5 MiB. Elsewhere in the home directory, paths had to match patterns covering items such as wallets, private keys, seed phrases, .env files, configurations, databases, documents and screenshots.
The scanner skipped directories including .ssh, .aws, .gnupg, .kube and .config, but those exclusions did not restrict the remote-control module’s ability to access files permitted by the current user’s privileges.
Remote commands and clipboard monitoring
The remote-control module supported directory listings, file uploads, command execution and interactive terminal sessions. It could also read the clipboard once per second and send changed, nonempty contents to a remote endpoint. SlowMist did not verify the cross-platform operation of its terminal implementations.
The analyzed code recorded process IDs in temporary files, but SlowMist found no macOS startup service, Windows scheduled task or Linux scheduled job providing persistence across system reboots. Detached execution and PID records alone do not establish reboot persistence.
How to check a potentially affected workstation
These checks come from SlowMist’s recommendations; they are not a procedure independently tested for this article.
- Establish whether the terminal profile was used. For
Hylance/sol-liveon macOS or Linux, check whether someone selected and launched its project-definedzshorbashprofile. Merely opening the folder does not demonstrate that this chain ran. - Locate the loader in the correct working directory. Check for a literal
~directory containing.vscode/cache/app.jsbeneath the project directory or the terminal’s actual starting directory. Do not limit the search to the user’s home-directory cache. - Check process artifacts and network records. Look for
pid.2.1.lock,pid.2.2.lockandpid.2.3.lockin the system temporary directory, alongside Node.js processes and connections to172[.]86[.]112[.]107. - Correlate evidence rather than relying on one artifact. Review proxy, DNS and endpoint detection logs. For related Windows projects, assess their actual commands before checking
$PROFILE,%temp%\settings.cmdor Defender exclusions; these are not interchangeable indicators for every repository. - If execution is confirmed or cannot be ruled out, isolate the host and preserve investigation evidence. Carry out credential changes and wallet recovery from a trusted device.
For that last situation, SlowMist recommends treating wallet seed phrases and private keys used or stored on the host as exposed: create a new wallet on a trusted device, move assets and review the old addresses’ contract approvals. This is a precautionary response, not evidence that the report proved those secrets were stolen.
The team also recommends rotating relevant account passwords, exchange API keys, SSH keys and cloud credentials. On macOS, it advises changing the login password and rotating relevant keychain credentials; changing the login password does not invalidate a previously copied keychain file.
Indicators for investigation
The following indicators are defanged and should not be visited:
| Indicator | Role described in the report |
|---|---|
www[.]enabledomain[.]app |
Loader endpoint domain |
codeprettier[.]pro, www[.]configs[.]live, www[.]tanxilabs[.]com |
Additional domains listed in the investigation |
172[.]86[.]112[.]107:8085 |
Browser-data uploads and remote file uploads |
172[.]86[.]112[.]107:8086 |
File-scanner uploads |
172[.]86[.]112[.]107:8087 |
Remote-control notification, connection and clipboard logging |
The SHA-256 fingerprint reported for sol-live.zip was:
573c5060ec782e3ec43d8db7be5042c2ed384017f90c6392799429d88e964c7d
SlowMist also identified eight other GitHub projects with similar terminal download-and-execute configurations. Its examination of those projects was preliminary; it did not retrieve and deeply analyze every remote payload. Repository links are investigation and reporting references, not grounds for blocking all of github.com.
Before opening another interview project
Review .vscode/settings.json before launching project-defined terminals. Check custom profiles, defaultProfile settings and startup arguments for download-and-execute commands, background execution, writes to $PROFILE and use of eval.
A hidden .vscode directory combined with whitespace-obscured terminal commands is a high-risk signal. The absence of a default malicious profile is not enough to make a project safe: manually selecting that profile can still trigger execution.
Original SlowMist report — published October 23, 2026, at 18:20 UTC+8.