GCVE-110-OSM-2026-14142

This repository was compromised by the GhostAction campaign. An attacker using the owner's GitHub access pushed malicious files directly to it. It received a credential stealer disguised as a font file and a hidden VS Code task that runs it when the folder is opened (added October 19, 2026). Anyone who opened the project in VS Code with automatic tasks allowed after October 19, 2026 should treat that machine's credentials as compromised, because the stealer also installs a scheduled job that runs commands from the attacker's server every five minutes. ## Payload 1: cut-down credential stealer disguised as a font file Malicious payload found in: `public/fonts/fa-solid-400.woff2` First pushed October 19, 2026. Despite the `.woff2` extension this is a short, unobfuscated Node.js script, shorter than earlier versions. When run it reads `~/.aws/credentials`, `~/.pypirc`, `~/.npmrc`, `~/.git-credentials` and `~/.claude/.credentials.json`, the SSH private keys `id_rsa` and `id_ed25519` in full, and environment variables whose names begin with `AWS_`, `ANTHROPIC`, `OPENAI`, `HF_TOKEN`, `GITHUB_TOKEN`, `_API_KEY` or `_TOKEN`. Unlike earlier versions it does not read `.netrc`, `.gemini` or `.kube/config` and does not search the home directory for token patterns. It sends everything with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 8080 with no batch tag. It then installs the same crontab entry, marked `#ghc2`, that every five minutes downloads a script from the same server at a path keyed by the machine's hostname and pipes it to `bash`, which gives the operator remote command execution. The file does nothing on its own: it runs when the VS Code task below, or `node`, executes it. ## Payload 2: VS Code launcher Malicious payload found in: `.vscode/tasks.json` First pushed October 19, 2026. Defines a hidden shell task labelled `eslint-check` that runs `node ./public/fonts/fa-solid-400.woff2` with its output suppressed. The JSON is laid out on fewer lines than other copies but behaves identically. It is set to run automatically when the folder is opened (`runOptions.runOn: folderOpen`), so it starts as soon as the workspace is trusted and automatic tasks are allowed in VS Code. The task sends nothing and installs nothing itself.