VS Code Backdoor in Solidity Project Targets Crypto Data
SlowMist found a data-stealing backdoor in the GitHub repository Hylance/sol-live, presented as a Solidity interview practice project. The malicious code is hidden in VS Code workspace settings and can run when users select the project’s custom terminal configuration. On macOS and Linux, it downloads and executes a remote script; Windows execution remains unconfirmed because of a possible quoting error.
Analysis of archived code and retained payloads found capabilities to collect browser login databases and wallet extension data, copy macOS Keychain files, scan and upload local files, monitor clipboard contents, and run commands through a remote-control channel. The code’s browser password decryption function returns an empty value, and investigators did not verify that passwords, seed phrases or private keys were decrypted or stolen. They also did not execute the sample or confirm infections or data exfiltration on victim devices.
SlowMist says users who launched the project’s malicious terminal configuration should investigate their devices and, if exposure cannot be ruled out, move wallet assets and rotate credentials using a trusted device. The incident highlights software supply-chain risk for crypto developers: opening the repository alone is not confirmed to trigger the backdoor.
Neutral
The report points to a serious security risk for individual developers and crypto users, but it does not establish a market-wide breach, confirmed victim count, or verified loss of funds. The analysis was based on archived code and retained payloads; the researchers did not run the malware or confirm that wallet secrets were decrypted or stolen. The browser-password decryption routine reportedly returns an empty value, which further limits claims about what attackers actually obtained.
In the short term, affected developers may review endpoint and network logs, rotate credentials, migrate wallets from trusted devices, and revoke risky contract approvals. Such targeted precautions could create limited concern among users of the named repository or related projects, but the article offers no evidence of broader disruption to crypto trading, exchange operations, or blockchain networks. Similar developer-tool and supply-chain malware disclosures have generally prompted security checks and heightened caution rather than sustained changes in major crypto prices, unless they are followed by confirmed, large-scale asset theft.
Over the longer term, the incident may encourage stricter review of VS Code workspace settings and other developer configurations, as well as better malware scanning for repositories. Traders should monitor for confirmed infections, stolen assets, or wider campaigns before treating this as a market catalyst. On the information available, the likely effect is a contained security concern rather than a directional signal for crypto prices.