Open Source Deception: How Fake Solidity Projects on GitHub Steal Crypto Wallet Data

A recent security investigation has exposed a dangerous trend on GitHub: repositories masquerading as helpful coding resources are actually traps designed to steal sensitive information from blockchain developers.

The Attack Vector: Malware Hidden in Plain Sight

The threat centers on a repository named "sol-live," which presented itself as a collection of Solidity interview practice questions. The malicious payload was not in the main source code, but cleverly embedded within the project's .vscode/settings.json file—a common configuration file for the Visual Studio Code editor.

When a developer opens the project in VSCode and runs the predefined custom terminal configuration, the attack initiates. This triggers the download and execution of a remote script with extensive capabilities:

  • Credential Harvesting: The script extracts browser login databases and local storage data from cryptocurrency wallet extensions.
  • System Access: On macOS systems, it attempts to access the Keychain to obtain stored credentials.
  • Remote Control: It can upload local files, execute remote commands, and provide an interactive shell back to the attacker.
  • Real-time Surveillance: The malware monitors the system clipboard, aiming to capture copied seed phrases or private keys.

Execution Requirements and OS Specifics

This attack requires user interaction to succeed. On both macOS and Linux systems, the developer must intentionally launch the malicious terminal configuration within VSCode for the script to run. This reduces worm-like propagation but effectively targets curious or unsuspecting developers.

The attack chain's effectiveness on Windows is currently unconfirmed due to potential issues with quote handling in the script, but the risk remains present.

Expanding Threat Landscape: Multiple Repositories Identified

Alarmingly, "sol-live" is not an isolated case. Security analysts have identified eight additional GitHub projects employing the identical technique. These repos disguise themselves as coding tutorials, tools, or boilerplate templates, exploiting the trust inherent in the open-source community.

The full scope of the infection and whether any data has been successfully exfiltrated remain unknown. This scatter-shot approach specifically targets the high-value blockchain developer community.

Immediate Action Steps for Developers

If you regularly clone or download projects from GitHub for work or study, consider these critical security practices:

  • Pre-Run Inspection: Before running any project from an unverified source, meticulously examine its .vscode/settings.json file and any terminal launch scripts or configurations.
  • Post-Execution Response: If you suspect you've executed a suspicious configuration, disconnect the device from the network immediately and perform a thorough security scan and isolation. Look for unusual processes or network connections.
  • Asset Safeguarding: If a device is confirmed compromised or cannot be fully cleansed, the safest course is to generate a new wallet on a fresh, secure machine and migrate all assets. Simultaneously, update all associated login credentials and API keys.

The collaborative nature of open source must not become an Achilles' heel. Maintaining vigilance and reviewing code are fundamental security habits for every developer.