SlowMist Security Team recently issued a warning: a malicious activity targeting developers has not just appeared recently, but has been present on GitHub for the past 7 months.

Specifically, attackers use fake job postings as bait to lure developers into downloading what appears to be a normal VS Code project. When you open this project, hidden malicious tasks will quietly run—users are often unaware. Once activated, these tasks can steal sensitive data from services like Vercel.

This method is particularly dangerous because it targets the developer community. Job hunting season makes it especially easy to fall for such scams. The security team emphasizes that developers must stay vigilant when encountering unfamiliar code projects, especially when the recruitment channels are unverified. Additionally, regularly reviewing VS Code extensions and project configurations for abnormal startup scripts or background tasks is an important step in prevention.