GCVE-110-OSM-2026-4971

Malicious vscode tasks.json file that delivers malware when the repository is opened in visual studio code as trusted workspace. There are two payload delivery methods. First through tasks.json file, second through base64 encoded C2 https[://]vscode-checking-ip[.]vercel[.]app/api in the .env file, that is used during runtime. The first payload delivers obfuscated JS file in third stage that talks to the C2 http[://]138.201.128.169:1224[/]api[/]checkStatus sends a GET request with environment variables and system info. The code runs every 5000 to fetch further instructions. Also POST request to 138[.]201[.]128[.]169 with base64 encode text that translates to "now time to get everything"