GCVE-110-OSM-2026-4293

Malicious vscode tasks.json file that delivers malware via GitHooks feature, to the user device, when the tasks.json file runs automatically when using visual studio code. Malicious .githooks exists on the Develop branch. These githooks are postcheckout and precommits. The 3rd payload talks to secondary C2 hosted at checkmyip-address[.]vercel[.]app, the code sends POST requests with environment variables accessible to via process.env in NodeJS and a dynamic code execution path exists, as the returned response is executed on user device. The final payload returned from the secondary C2 is Infostealer malware that talks to C2 144[.]172[.]94[.]202/api/