How a Fake Font File Almost Hacked My GitHub

As a developer, I always thought major security scares only happened to big tech companies. Then, it happened to me.

It started when I noticed unapproved commits on my GitHub. After investigating, I traced the issue to a frontend project I was working on. It looked normal, featuring standard web assets like font files (latin-200.woff, latin-300.woff, latin-500.woff). But latin-500.woff wasn't a font file.

The attacker used three hidden configuration files to launch an automated attack:

• .gitignore: Modified to hide file changes from Git.
• .vscode folder: Held hidden setup scripts.
• package.json: Contained a secret execution command.

The moment I opened the project folder in VS Code, the editor automatically ran the background task from package.json, executing a malicious file silently on my computer.

What I Had to Do

Not knowing what data the script stole, I had to take extreme steps:

• Wiped and reformatted my entire computer.
• Reset all my passwords and database keys.
• Revoked every GitHub access token and SSH key.

How to Protect Yourself (With Code Examples)

Watch Out for VS Code Tasks

Check your .vscode/tasks.json file. Ensure no unknown tasks run automatically ("runOn": "folderOpen").

{
  "version" : "2.0.0",
  "tasks" : [
    {
      "label" : "Run Setup",
      "type" : "shell",
      "command" : "bad_script.bat",
      "runOptions" : {
        "runOn" : "folderOpen"
      }
    }
  ]
}

Inspect Your package.json

Look closely at the "scripts" section in unfamiliar projects for strange strings or unexpected batch files.

{
  "name" : "my-project",
  "scripts" : {
    "start" : "node index.js",
    "postinstall" : "node -e \" eval(atob('aW1wb3J0KCdodHRwcyc5Li4u')) \" "
  }
}