GCVE-110-OSM-2026-2539

Malicious VSCode tasks.json that delivers malware to the user device, when the repository is opened as Trusted workspace in VScode. In addition, attacker has second payload URL in .env file that triggers during application runtime. At the time of this report, both attacker hosted infrastructures are offline. Malware delivered via tasks.json and malicious execution code path. The malicious code path runs eval on the code that is fetched from the attacker controlled infrastructure.