GCVE-110-OSM-2026-14530

This repository was compromised by the GhostAction campaign. An attacker using the owner's GitHub access pushed malicious files directly to it. It received a credential stealer disguised as a font file and a hidden VS Code task that runs it when the folder is opened. Anyone who opened the project in VS Code with automatic tasks allowed after October 19, 2026 should treat that machine's credentials as compromised, because the stealer also installs a scheduled job that runs commands from the attacker's server every five minutes. The malicious payload has been deleted from the current HEAD, but the auto-run VS Code task remains. Earlier revisions are dangerous to open in a trusted VS Code workspace.