PANews October 23 reported that SlowMist issued a security alert, stating that it recently received a user report about a repository named sol-live, disguised as a Solidity interview practice project,GitHub that conceals malicious code. The malicious payload contains three main modules capable of collecting browser login databases and wallet extension storage data, copying macOS Keychain files, scanning and uploading local files, executing remote commands, providing interactive Shell access, and monitoring clipboard contents. SlowMist stated that on macOS and Linux systems, the attack requires the user to actively launch the malicious terminal configuration; the attack chain for Windows systems has not yet been confirmed. In addition, SlowMist discovered another 8 project GitHub using a similar terminal download-and-execute technique.
PANews reported that SlowMist issued a security alert.
02
The repository named sol-live is GitHub disguised as a Solidity interview practice project and conceals malicious code.
03
The malicious payload can collect browser login databases and wallet extension storage data, copy macOS Keychain files, and scan and upload local files.
04
The malicious payload can also execute remote commands, provide interactive Shell access, and monitor clipboard contents.
05
On macOS and Linux systems, the attack requires the user to actively launch the malicious terminal configuration.
06
The attack chain for Windows systems has not yet been confirmed.
07
SlowMist also discovered another 8 project GitHub using a similar terminal download-and-execute technique.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
This is a malicious project incident targeting developers and cryptocurrency wallet users. The project appears to be a Solidity interview practice project, but actually contains functionality capable of reading browser, wallet extension, and local file data; on macOS and Linux, actively launching the malicious terminal configuration is one of the attack conditions.
Why it matters to readers
The relevant code may access browser login data, wallet extension storage, local files, and the macOS Keychain, and has capabilities for remote commands, interactive Shell access, and clipboard monitoring.
Do not run a project's GitHub terminal configuration merely because it appears to be a learning or interview practice project; whether an attack chain exists on Windows remains unconfirmed.
Risks and unknowns
No victim count or confirmed asset losses were provided.
The attack chain for Windows systems has not yet been confirmed.
The specific addresses and disposition details of the 8 similar projects were not provided.
The evidence does not indicate whether the project has been delisted or whether the malicious payload remains executable.
Related Developments
Loading event timeline…
Related concepts
Malicious Payload
This term is not in the glossary yet. Browse related concepts in the glossary.
