Malicious Code Discovered in GitHub Project Template

According to PANews, a user named evada recently reported on the V2EX website that during a job application process, they were asked to use a GitHub project template provided by the recruiter. It was discovered that the project contained malicious code. Specifically, the logo.png file, which appeared to be an image, actually contained executable code. This code was triggered through the config-overrides.js file with the intent to steal local cryptocurrency private keys. Evada highlighted that the malicious code sends requests to a specific URL to download a trojan file, which is then set to run automatically at startup, posing significant stealth and danger. V2EX administrator Livid stated that the account involved has been banned, and GitHub has removed the related malicious repository. Several users commented that this new type of scam targeting programmers is highly deceptive, urging developers to exercise caution when running projects from unknown sources.