GCVE-110-OSM-2026-598

Advisory PublishedCVSS 5.4/10

Vulnetix · Advisory published June 10, 2026

Malicious vscode task.json that delivers malware to user device, when the repository is opened in visual studio code. At the time of this writing the stage 2 payload hosting infrastructure is taken down/inactive https[://]vscode-settings-422-self[.]vercel[.]app/api[/]settings[/]bootstraplinux

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

5.4/10

Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions	Platforms
unknown	sbx-mask	all (affected), * (affected)	—
unknown	yelp-biz-action-constants-js-generated	all (affected), * (affected), all (affected), all (affected), * (affected), all (affected), all (affected), * (affected), all (affected)	—
unknown		all (affected), all (affected)	—
unknown	customerdigital-ui-components-lib	* (affected), all (affected), all (affected), all (affected)	—