GCVE-110-OSM-2026-13736

This is a legitimate project repository that was compromised in the GhostAction campaign. Using access to the owner's GitHub account, an attacker added a hidden VS Code task that runs automatically when the project folder is opened and executes a file disguised as a font. In the rest of the cluster that file is a credential stealer that also installs a cron job giving the attacker remote command execution on the machine. The task file matches, byte for byte, the one found in dozens of other compromised repositories. The repository has since been deleted, renamed or made private, so the rest of its contents could not be examined. Anyone who cloned or pulled it and opened it in VS Code with automatic tasks allowed should treat that machine's credentials as compromised. ## Payload 1: VS Code launcher Malicious payload found in: .vscode/tasks.json Defines a hidden shell task labelled `eslint-check` that runs `node ./public/fonts/fa-solid-400.woff2` with its output suppressed (`isBackground`, `hide` and `reveal: never`). It is set to run automatically when the folder is opened (`runOptions.runOn: folderOpen`), so it starts as soon as the workspace is trusted and automatic tasks are allowed in VS Code. The file is byte-identical to the launcher in the other repositories of this GhostAction cluster. ## Payload 2: credential stealer disguised as a font (not verified in this repository) Expected in: public/fonts/fa-solid-400.woff2 This repository was no longer accessible when its contents were checked, so the file the task runs could not be examined. In the rest of the cluster it is a 38-line plain Node.js script, not a font. It reads credential files from the home directory (cloud, package registry, Git and Kubernetes credentials, and the Claude and Gemini login files) and the full SSH private keys, searches the home directory for token patterns, collects secret-looking environment variables, and POSTs everything over plain HTTP to the GhostAction server. It then installs a crontab entry that every five minutes downloads a script from the same server and pipes it to `bash`, which gives the operator ongoing remote command execution. It does nothing on its own: it must be started by the launcher or run with `node`. Whether this repository also carried the first-stage or second-stage GitHub Actions workflows is not known.