How a Fake Font File Almost Hacked My GitHub

As a developer, I always thought major security scares only happened to big tech companies. Then, it happened to me.

It started when I noticed unapproved commits on my GitHub. After investigating, I traced the issue to a frontend project I was working on.

It looked normal, featuring standard web assets like font files (latin-200.woff, latin-300.woff, latin-500.woff). But latin-500.woff wasn't a font file.

The attacker used three hidden configuration files to launch an automated attack:

• .gitignore: Modified to hide file changes from Git.
• .vscode folder: Held hidden setup scripts.
• package.json: Contained a secret execution command.

The moment I opened the project folder in VS Code, the editor automatically ran the background task from package.json, executing a malicious file silently on my computer.

What I Had to Do

Not knowing what data the script stole, I had to take extreme steps:

• Wiped and reformatted my entire computer.
• Reset all my passwords and database keys.
• Revoked every GitHub access token and SSH key.

How to Protect Yourself (With Code Examples)

1. Watch Out for VS Code Tasks Check your .vscode/tasks.json file. Ensure no unknown tasks run automatically ("runOn": "folderOpen").

{
    "version": "2.0.0",
    "tasks": [
        {
            "label": "Run Setup",
            "type": "shell",
            "command": "bad_script.bat",
            "runOptions": {
                "runOn": "folderOpen" // ⚠️ Runs automatically when opening the folder!
            }
        }
    ]
}

1. Inspect Your package.json Look closely at the "scripts" section in unfamiliar projects for strange strings or unexpected batch files.

{
  "name": "my-project",
  "scripts": {
    "start": "node index.js",
    "postinstall": "node -e \"eval(atob('aW1wb3J0KCdodHRwcyc5Li4u'))\"" // ⚠️ Suspicious encoded string!
  }
}