GCVE-110-OSM-2026-13630

Fake smart-contract job-interview assignment that executes malware when the folder is opened in VS Code or the repo is checked out. Same lure template, dropper host and token as the separately reported 6figuresdev/uche_TokenSol_challenge. The account has the same auto-run task and payload file in many other repositories. === PAYLOAD 1: Git hook dropper === Malicious payload found in: .githooks/post-checkout Attack vector: .vscode/tasks.json task "Git checkout to default branch" (runOn=folderOpen) runs `git config core.hooksPath .githooks; git checkout master`, triggering the hook. The hook branches on uname and pipes a remote script into sh (macOS: curl, Linux: wget) or cmd (Windows), output suppressed. Stage-2 content not retrieved (host returned HTTP 451). Dropper URLs recorded in verified_iocs. === PAYLOAD 2: Obfuscated JS disguised as font === Malicious payload found in: test/utils/public/fonts/fa-solid-900.eot (40,134 bytes) Attack vector: hidden task "eslint-check" (runOn=folderOpen) runs `node ./test/utils/public/fonts/fa-solid-900.eot`. File is a single-line _0x-obfuscated JavaScript file, not a font. Byte-identical to the payload in 6figuresdev/g2strade-master and tochukwu5/g2strade. Not deobfuscated; C2/exfil targets unknown. The same tasks.json + fake fa-solid-900.eot pattern appears in 21 other repositories of this account (pushed within ~2 minutes on 2026-10-09 after history rewrite on 2026-10-06), so the account may be compromised or operated by the campaign actor; not determined.