sol0 developer. Talk less do more. building @solz_fun
Berlin | Bali
Joined March 2026
- Tweets188
- Following154
- Followers21
- Likes205
You need 3 steps, and none of them need to run or install:
1. Clone the repo.
2. Open the folder in VS Code and click Trust.
3. Open a terminal in VS Code. VS Code can also do this for you, for example when it restores a terminal from your last session.
When the terminal opens, the payload downloads and runs right away. npm install and npm start are not needed. They are a second way in.
----
The file .vscode/settings.json changes the default terminal in VS Code. When you open the folder in VS Code and start a terminal, it quietly downloads a script and runs it:
It runs in the background with all output hidden, then shows a normal shell, so you see nothing unusual. The same file also hides the .vscode folder ("files.exclude": {"**/.vscode": true}), so you would not see this file in the VS Code sidebar. The first line is padded with hundreds of spaces to push the payload out of view.
Crypto bros, be careful when opening cloned projects in VS Code or VS Code forks (Cursor, Trae, etc.); you can get hacked instantly now.
The initial pattern is similar, but if you go through these steps (just leave immediately) :
> any job interview from telegram (HIGH alert)
> then an interview disguised as a code structure explanation (suspicious) - also usually broken pronunciation
> cloning the repo triggers a hack immediately, even without installation
more info how it works 👇
Engineers in Bali don't touch grass, we touch sand.
Also just recovered from my back injury; this is the 3rd time this year😭
Almost fall to another scam attack! A campaign using real Google-hosted documents, custom sidebars, fake update prompts, and malware delivery. Attacker is baiting users via @OrangeDAOxyz campaign.
Once Inside, then a document claims something has failed and directs the user to an alleged update.
If it's a browser app, nothing ever from userside to update something. the downloaded script to update google api is a malicious script.
8 heroes are in draft, but only three will be ready for release. Heroes will be introduced at the same time as the labyrinth system later this week
#shipaton