Suspicious VS Code auto-execution task found in my GitHub repository – possible malware injection

[pasindu7828]

🏷️ Discussion Type

Bug

💬 Feature/Topic Area

Code quality

Discussion Details

Hello GitHub Community,

I am a university student working on a group research project hosted on GitHub.

Recently, I discovered unexpected .vscode folders in our repository that I did not intentionally create.

During an initial investigation, I noticed the following suspicious behavior:

1. A .vscode/tasks.json file appeared in the repository without my knowledge.
2. The configuration contained "runOn": "folderOpen", suggesting that a task could execute when the project was opened in VS Code.
3. The task appeared to invoke Node.js to execute a file with a .woff extension.
4. The task also contained settings that could hide its execution.
5. I previously opened and worked on this repository using VS Code before removing the suspicious .vscode folders.

I have now removed the .vscode folders from the current repository, but I am concerned that suspicious files may remain in the commit history or elsewhere in the project.

Repository:

https://github.com/pasindu7828/Green-Blue-Urban-Environmental-Intelligence-Using-Geospatial-Data-and-Machine-Learning---J26-DS-338

Relevant commit for investigation:

pasindu7828/Green-Blue-Urban-Environmental-Intelligence-Using-Geospatial-Data-and-Machine-Learning---J26-DS-338@094438c

I would appreciate guidance on the following questions:

• How can I determine whether these files were introduced through unauthorized access or by a legitimate contributor?
• How can I verify whether the suspicious VS Code task actually executed on my Windows laptop?
• What steps should I take to secure my GitHub account and local computer?
• How can I safely remove potentially malicious files and prevent this from happening again?

I have not yet confirmed whether my laptop or GitHub account has been compromised.

Thank you for your support and guidance.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[rjsgud49]

I looked through the public history of the repo, and there's more than the .vscode folder. Some of it is still on main.

Where it came from. The malicious tasks.json is already in the very first commit (e367338, Aug 11), together with public/fonts/fa-solid-400.woff2. So it came in with the code the project was started from. Nobody added it to GitHub later. After that it was re-added under other folders (Urban_Heat_Research/.../fonts/fa-brand-400.woff, then Urban_Green_Research/...) through merges between branches. That's why deleting .vscode on one branch didn't stick.

The commit to look at closely is 9b86e67 (Oct 22, pushed from git as pasindu7828). Its message says "Delete .vscode directory", but it actually:

• changes tasks.json to run a new file, fa-brand-400.orc
• adds Urban_Heat_Research/src/utils/session.py
• adds import utils.session to Urban_Heat_Research/src/01_data_understanding.py

session.py reads a transaction from an Ethereum address (through api.ethplorer.io / ethereum.publicnode.com), decodes JavaScript from it, and runs it with node. So simply running 01_data_understanding.py runs the payload, even with VS Code closed.

You already removed the tailwind.config.js injection (the code hidden after a long run of spaces) and node api.js from the npm scripts on Oct 27. The following files are still there:

Branch	Still present
main, development	Urban_Heat_Research/src/utils/session.py, the import utils.session line, and fa-brand-400.woff / .orc under Urban_Heat_Research/data/raw/boundary/public/fonts/ and Urban_Green_Research/.../public/fonts/
the 4 member branches	fa-brand-400.woff / .orc under .../public/fonts/

The .woff/.orc files aren't fonts. They're obfuscated JavaScript (they start with (function(). The real Font Awesome files next to them are fa-brands-400.* with an "s".

What I'd do:

1. Delete those files and the import from every branch. Then search the whole history for more:

   git fetch --all
   git log --all --oneline -- '**/tasks.json' '**/fa-brand-400.*' '**/session.py'
   git log --all --oneline -G 'runOn|ethplorer|publicnode|createRequire|fromhex'

   On the current checkout, also look for very long lines (git grep -nE '.{2000,}' -- '*.js' '*.mjs' '*.cjs' '*.py' '*.json'). That's how the tailwind one was hidden.
2. Treat every machine that opened the folder in VS Code (with trust enabled), ran npm run dev/build, or ran the Python scripts as possibly infected. That's probably yours and your teammates' machines. Scan them, then change your GitHub password and review Settings → Sessions, SSH and GPG keys, Developer settings → Personal access tokens, Applications, and remove anything you don't recognise. Also rotate any other secrets used on those machines (browser-saved passwords, crypto wallets, API keys).
3. Have everyone set "task.allowAutomaticTasks": "off" in VS Code. Opening unknown repos in Restricted Mode also blocks folderOpen tasks (VS Code docs). .gitignore alone won't stop a file that was added on purpose.

On "unauthorized access vs. a contributor": git author and committer names can be faked, so the history alone can't prove who pushed 9b86e67. What it does show is that the commit came from a local git client, not the web editor, and that it reused an old commit message while doing something else. That fits malware running on a machine with write access to the repo (yours or a teammate's). It doesn't fit a teammate making the change by hand. GitHub Support can tell you more about a specific push if you need proof.