SlowMist Uncovers Malicious GitHub Repo Disguised as Solidity Test

The cybersecurity firm SlowMist has issued a high-priority security alert regarding a fraudulent GitHub repository named sol-live. Disguised as a legitimate collection of Solidity interview practice questions, the project contains a sophisticated backdoor designed to exfiltrate sensitive data from developers. This discovery highlights an evolving threat vector where malicious actors target blockchain engineers through social engineering and technical deception within open-source development environments.

Mechanism of the sol-live Backdoor

According to technical analysis, the malicious payload within the repository is composed of three primary modules. These components are engineered to compromise both the user's local environment and their digital assets. The malware targets critical data points, including:

• Extraction of browser login databases and stored credentials.
• Unauthorized access to cryptocurrency wallet extension storage data.
• Duplication of macOS keychain files to gain access to encrypted passwords.
• Scanning and automated uploading of local files to a remote server.
• Execution of remote commands and providing interactive Shell access to the attacker.

SlowMist noted that the malware also monitors clipboard content, a common tactic used by attackers to intercept private keys or seed phrases when they are copied by the user.

Cross-Platform Risks and Related Threats

The security firm emphasized that the attack requires specific user actions to be successful. On macOS and Linux systems, the infection is triggered when a user actively launches malicious terminal configurations provided in the repository. While the attack chain for Windows systems has not yet been fully confirmed, the potential for cross-platform exploitation remains high.

SlowMist's investigation revealed that this is not an isolated incident. The researchers identified eight additional GitHub projects employing nearly identical methods for terminal-based downloads and execution of malicious code. These findings suggest a coordinated campaign targeting the Ethereum development community and users of the Solidity programming language.

This malicious payload contains three main modules capable of collecting browser login database and wallet extension storage data, copying macOS keychain files, scanning and uploading local files, and can also execute remote commands.

Developers and security researchers are advised to exercise extreme caution when cloning repositories from unknown sources, even if they appear to be educational or career-oriented. SlowMist recommends verifying the integrity of scripts and terminal configurations before execution. As the DeFi and Web3 ecosystems continue to expand, the targeting of technical talent through platforms like GitHub remains a significant risk factor for the industry's overall security infrastructure.