Repository navigation
Security: .vscode/tasks.json in this repository runs malware when the folder is opened #530
Description
Hello. I research phishing and malware, and I am posting here so the owner of this repository sees this. On November 5 I sent an email about this and have not heard back, so I am posting here in case it did not reach you. I read these files on November 9, 2026, and you can confirm all of this by viewing them on GitHub, without downloading anything.
This repository contains malware:
- freshdata:
.vscode/tasks.jsonrunspublic/fonts/fa-solid.lkfwhen the folder is opened in VS Code.
The font-named files are not fonts. They are JavaScript, usually obfuscated and on one very long line. .vscode/settings.json may also set task.allowAutomaticTasks to true, which stops VS Code asking before it runs the task.
This matches the PolinRider campaign, which public research links to North Korea's Contagious Interview operation. Public research reports that the code downloads a program that steals credentials and crypto wallets, then pushes the same code into the developer's other repositories.
Please follow these steps in order, because new credentials entered on an infected computer can be stolen too.
- Do not open this project in VS Code or an editor built on it, such as Cursor or Windsurf, and do not install, build or run it, until the code is removed.
- If you opened, built or ran it after the code arrived, treat that computer as compromised. Back up what matters, take it off the network, and clean or reinstall it. Commit dates can be forged, so if you cannot tell when the code arrived, assume the computer is affected.
- Then, from a clean computer, replace every credential that computer could reach, including GitHub tokens, SSH keys, npm and cloud accounts,
.envfiles, saved browser passwords and AI tool logins. Move any crypto to a new wallet. - Then revoke your GitHub personal access tokens, SSH and deploy keys and any OAuth apps you do not recognize, and check your account's security log. Turn on branch protection that blocks force pushes: this campaign rewrites cleanup commits to put the code back.
- Then remove everything listed above, and check every config file and every
package.jsonin each project, including in subfolders. Commit authors and messages can be forged as well as dates.
This post has no links, and I am not asking you for anything. I have not reported this to GitHub. Detection here is largely automated and mistakes are possible, so please verify this yourself. If I am wrong, tell me here and I will retract it. If you would rather talk privately, you can reach me at jay@risingsunsolutions.com. Once you have dealt with this, you can close or delete this issue.
Jay Maier, Rising Sun Solutions LLC, phishing and malware threat intelligence
Activity
security: remove PolinRider malware dropper, vscode auto-tasks, and a…
JohnnyWilson16 commentedon Nov 10, 2026
Hello @jaym2026 ,
Thank you for reporting this and providing the specific indicators. We investigated and confirmed the threat:
6cdf67b(merged intomainvia commit1c26fbb) introduced.vscode/tasks.json(runOn: folderOpen),.vscode/settings.json(task.allowAutomaticTasks: true),public/fonts/fa-solid.lkf(obfuscated JavaScript dropper payload), and decoy font files.main.tests/security-vscode-audit.test.mjs) and CI gate (.github/workflows/security-gate.yml) to continuously block auto-run editor tasks, automatic execution settings, and script payloads in asset paths.Closing this issue as resolved.
jaym2026 commentedon Nov 10, 2026
An update. Since posting this, I have downloaded and examined the code this malware installs on a developer's computer. It changes what you need to do, even if you have already removed it from your repositories.
Once a project is opened in VS Code, built or run, the malware uploads every environment variable, opens a backdoor, and copies saved browser passwords and cookies, password-manager vaults, crypto wallets and GitHub credentials. It stays on the computer after the repositories are cleaned, and the stolen GitHub credentials let the code be pushed back after you remove it.
If nobody opened, built or ran the infected projects on their computer, step 3 and the last step still apply, because your GitHub credentials may have been taken from a collaborator's computer.
Please follow these steps in order, because new credentials entered on an infected computer can be stolen too.
~/.git-credentials, the GitHub CLI token (~/.config/gh/hosts.yml) and VS Code's stored sign-in data, so whoever runs it can push to your repositories without your computer. Revoke all personal access tokens, OAuth app and GitHub App grants, and SSH and deploy keys; sign out of all sessions; check your account's security log; and turn on branch protection that blocks force pushes..envfiles (it uploads them as soon as it starts); passwords saved in your browsers, then sign out of all sessions, because it copies cookies too; the master password of your password manager, because it copies 1Password, Bitwarden, LastPass, KeePass, Dashlane and NordPass vaults; npm, cloud and AI tool logins; and any crypto, moved to a new wallet with a new recovery phrase..node_modulesfolder in your home folder (not a project'snode_modules); reinstall Node.js, including every nvm version, because the malware adds code to npm's ownlib/cli.js; and reinstall VS Code, Cursor, Antigravity, Discord and GitHub Desktop, because it patches their program files (any*.inz.cjsfile is a sign of this). On Windows, also delete%APPDATA%\npmand%LOCALAPPDATA%\Programs\Python\Python3127.package.jsonin each project, including in subfolders.Detection here is largely automated and mistakes are possible, so please verify this yourself. If I am wrong, tell me here and I will retract it. If you would rather talk privately, you can reach me at jay@risingsunsolutions.com.
Jay Maier, Rising Sun Solutions LLC, phishing and malware threat intelligence