# SlowMist Warns of GitHub Project Targeting Crypto Wallet Data

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/39518
Published: 2026-10-24T01:42:23.000Z
Updated: 2026-10-24T01:42:23.000Z
Section: Technology

> The sol-live repository hides a command in VS Code settings. SlowMist also identified eight other GitHub projects using similar techniques.

SlowMist warned that a GitHub project named sol-live can run hidden malware targeting wallet extensions and other sensitive data, putting developers who manually start its configured terminal at risk.

The repository presents itself as a Solidity interview-practice project. Its malicious command is concealed in a VS Code workspace settings file, .vscode/settings.json, and requires a user to start a particular terminal configuration to trigger the attack.

The listed targets include browser login data, wallet-extension information and macOS Keychain files. The malware can also upload local files, run commands remotely and monitor clipboard contents.

SlowMist identified eight other GitHub projects using similar techniques. It described execution risks on macOS and Linux, while a Windows attack path has not been confirmed. SlowMist did not specify the number of infections or confirm whether data had been exfiltrated.

SlowMist advised reviewing VS Code settings and terminal startup arguments in untrusted projects. For suspected compromise, it recommended isolating the device, moving wallet assets using a trusted device and changing related credentials.