GCVE-110-OSM-2025-1141

VS Code tasks.json with malicious curl|bash payload that executes on folder open. Part of Contagious Interview campaign targeting developers. Malicious payload found in: .vscode/tasks.json C2 URL: hxxps://260120[.]vercel[.]app/settings/linux?flag=9-test Attack vector: curl piped to bash/sh on folderOpen Presentation hidden (reveal: never, echo: false) ## Payload 2: fake font file (PolinRider 900 variant) Malicious payload found in: `prisma/generated/prisma/internal/public/fonts/fa-solid-900.woff2` - Trigger: a second, hidden background task labeled `eslint-check` in `.vscode/tasks.json` with `"runOn": "folderOpen"` runs `node ./prisma/generated/prisma/internal/public/fonts/fa-solid-900.woff2` when the folder is opened. The path is chosen to look like Prisma's generated client output. - Pushed to every branch on 2026-09-25 01:30 UTC. The file is 37,567 bytes of obfuscated JavaScript with build marker `global['!']='9-10094'`, a keyed shuffle cipher, and no whitespace padding. No indicators appear in plain text. ## Payload 3: ESLint config Malicious payload found in: `eslint.config.mjs` - Trigger: an obfuscated single line appended after the legitimate config and pushed off-screen with padding. ESLint flat config is a JavaScript module, so `npm run lint`, pre-commit hooks, CI lint jobs, or the editor's ESLint extension run it. No VS Code task is needed. - First added 2026-03-03. The line has been 5,293, 10,582, 7,596, 37,504, and 32,328 characters long across rewrites, with build markers `9-2078`, `8-1259`, `8-1586`, `8-1144`, and `9-10094` (`global['!']` marker family). ## Payload 4: Prisma config loader (removed 2026-09-25) Malicious payload found in: `prisma.config.ts` - For a period, an async loader Base64-decoded a URL from the `AUTH_API_KEY` environment variable (set in a committed `.env` file), fetched it with `node-fetch`, and passed the response to `eval()`. The 900-variant rewrites deleted it and removed `node-fetch` and `dotenv` from `package.json`. ## VS Code settings changes Malicious payload found in: `.vscode/settings.json` - The 900-variant rewrite replaced the file with a plausible team settings file that also sets `"task.allowAutomaticTasks": true`, `"terminal.integrated.hideOnStartup": "always"`, and `"debug.openDebug": "neverOpen"`, removing points where a developer might notice a task running. ## Persistence: auto-push tool on infected contributor machines Malicious payload found in: unknown (runs on infected developer machines, not committed to the repository) - The first malicious force-push was 2026-01-29 00:45 UTC. The repository was clean before that. - The malware on an infected contributor's machine takes the newest commit on each branch, keeps its author name, email, date, and message, replaces the contents with the payload, and force-pushes the result to every branch within seconds. Commit dates in `git log` do not show when a payload arrived. - `.gitignore` gains `config.bat`, `temp_auto_push.bat`, `temp_interactive_push.bat`, and `branch_structure.json` (the auto-push tool's working files). - Two 2026-05-21 cleanups were rewritten with the payload restored under the same commit titles ("Remove malicious obfuscated JavaScript from eslint.config.mjs" and "Fix ESLint configuration syntax"). The latter title has been carried by more than 100 rewritten commits.