SlowMist Uncovers Backdoor Hidden in Fake Web3 Interview Repository

A malicious GitHub repository disguised as a Solidity technical interview practice test has been observed deploying a multi-stage backdoor designed to siphon sensitive developer data, according to a security analysis published on Oct. 23 by SlowMist ¹.

The repository, titled "sol-live", purported to offer an eight-question Solidity exam to lower candidates' defenses ¹. Behind the coding questions, attackers planted concealed commands in the workspace configuration file located at .vscode/settings.json ¹. The operators injected hundreds of spaces to obscure the scripts from immediate view and added exclusion rules in the editor's settings to hide the .vscode directory within the VS Code file explorer ¹.

When a developer opens the project and launches a workspace terminal on macOS or Linux, the custom configuration executes a command line sequence ¹. The routine inspects the system for Node.js, installs runtime components if absent, writes an initial loader script into a local cache directory, and contacts a remote endpoint to fetch a payload ¹. SlowMist identified the secondary payload as an obfuscated JavaScript bundle of roughly four megabytes ¹.

Data Extraction Pipeline

According to SlowMist's offline script reconstruction, the secondary payload initiates three independent background processes ¹. These dedicated threads handle browser credential harvesting, file discovery and transmission, and remote system control ¹. The analysis determined that the collection routines scan for login databases across 13 Chromium-based browsers, macOS Keychain files, local device files, clipboard contents, and data directories tied to crypto wallet extensions ¹.

SlowMist stated that its analysis relied on offline reconstruction, archived source files, and preserved network responses ¹. The firm noted it did not execute the malware sample live, nor did it establish a command-and-control connection on its analysis machines ¹. Although the repository contained a Windows terminal configuration, syntax issues in its PowerShell command string left remote execution unconfirmed on that platform ¹. SlowMist alerted users through its MistEye monitoring network ¹.