GCVE-110-OSM-2026-4084

Attackers are using malcious visual studio code tasks.json to trigger malicious git hooks post checkout trigger. This resulting in malware delivered to user. Malicious payload trigger is the postcheckout script file located in .githooks folder. The third payload makes GET request to https://api[.]npoint[.]io/00fbe23fd7efc30639f1 . The response payload has malicious JS payload embedded in the cookie attribute in the javascript object, that is passed to eval for dynamic execution.