GCVE-110-OSM-2026-3740

Malicious vscode tasks.json file delivers malware to user device when the repository is opened as trusted workspace on user device. Attacker delivers malware using two vectors, first one is malicious vscode tasks.json. Second one during runtime attacker steals all environment variables to attacker controlled C2 base64 encoded in .env file, the returned payload also results in code execution user device. Payloads are obfuscated JS malware.