GCVE-110-OSM-2026-13633

Fake trading-website project that auto-executes obfuscated JavaScript when the folder is opened in VS Code. Part of a developer-targeting campaign by the same GitHub account (6figuresdev) that also hosts a fake smart-contract job-interview lure. === PAYLOAD 1: VS Code auto-run task === Malicious payload found in: .vscode/tasks.json Attack vector: hidden task "eslint-check" with runOn=folderOpen executes `node ./src/public/fonts/fa-solid-900.eot`; .vscode/settings.json sets task.allowAutomaticTasks=true. === PAYLOAD 2: Fake font file === Malicious payload found in: src/public/fonts/fa-solid-900.eot (40,134 bytes) Not a font: a single-line ASCII _0x-style obfuscated JavaScript file, executed by node via the task above. === PAYLOAD 3: Decoy API module === Malicious payload found in: api.js Mock API exports followed by a ~40KB single-line _0x-obfuscated payload. package.json dev script is `node api.js && vite`. Both obfuscated payloads were identified statically and not deobfuscated or executed; C2/exfil targets are unknown. Same account hosts uche_TokenSol_challenge, whose post-checkout hook fetches a script from gitconfig-nyx.vercel.app (reported separately). Commit author email across the account: juliuseze279@gmail.com.