GCVE-110-OSM-2026-3659

Attackers are using malcious visual studio code tasks.json to trigger malicious git hooks post checkout trigger. This resulting in malware delivered to user. Malicious payload trigger is the postcheckout script file located in .githooks folder. The attacker has 3 stage payloads, the final payload is fetched from https://api[.]npoint[.]io/6c1d60d35852ef0c05df. The final payload delivers obfuscated JS malware.