How a Fake Font File Almost Hacked My GitHub

Kaushal Verma — Tue, 27 Oct 2026 06:21:49 +0000

As a developer, I always thought major security scares only happened to big tech companies. Then, it happened to me.

It started when I noticed unapproved commits on my GitHub. After investigating, I traced the issue to a frontend project I was working on.

It looked normal, featuring standard web assets like font files (latin-200.woff, latin-300.woff, latin-500.woff). But latin-500.woff wasn't a font file.

The attacker used three hidden configuration files to launch an automated attack:

.gitignore: Modified to hide file changes from Git.
.vscode folder: Held hidden setup scripts.
package.json: Contained a secret execution command.

The moment I opened the project folder in VS Code, the editor automatically ran the background task from package.json, executing a malicious file silently on my computer.

What I Had to Do

Not knowing what data the script stole, I had to take extreme steps:

Wiped and reformatted my entire computer.
Reset all my passwords and database keys.
Revoked every GitHub access token and SSH key.

How to Protect Yourself (With Code Examples)

Watch Out for VS Code Tasks Check your .vscode/tasks.json file. Ensure no unknown tasks run automatically ("runOn": "folderOpen").

{
    "version": "2.0.0",
    "tasks": [
        {
            "label": "Run Setup",
            "type": "shell",
            "command": "bad_script.bat",
            "runOptions": {
                "runOn": "folderOpen" // ⚠️ Runs automatically when opening the folder!
            }
        }
    ]
}

Inspect Your package.json Look closely at the "scripts" section in unfamiliar projects for strange strings or unexpected batch files.

{
  "name": "my-project",
  "scripts": {
    "start": "node index.js",
    "postinstall": "node -e \"eval(atob('aW1wb3J0KCdodHRwcyc5Li4u'))\"" // ⚠️ Suspicious encoded string!
  }
}

DEV Community: Kaushal Verma

How a Fake Font File Almost Hacked My GitHub

What I Had to Do

How to Protect Yourself (With Code Examples)