GCVE-110-OSM-2026-4818

Malicious vscode tasks.json that delivers malware to the user device when the repository is opened in visual studio code. There are two mix of payloads in the tasks.json file, one is fetching the malicious code from attacker controlled infra, second one is obfuscated JS file spellright.dict in the .vscode folder that fetches payload from second attacker controlled domain www[.]whatisip[.]app[/]api[/]ip-check-encrypted[/]3aeb34a30. At the time of writing both infrastructures are taken down or offline.