I lost a significant amount of money due to a silent, zero-interaction dev environment exploit.
No wallet connection.
No signing.
No running the app.
Just cloning a repo and opening it in VS Code.
Malicious .vscode/tasks.json hooks can execute automatically on folder open once you trust the workspace, hidden, background execution. This is actively abused by DPRK Interview groups.
I work in Web3 and thought I was careful. This one is genuinely scary and unheard of for most devs.
Please treat untrusted repos like malware. Open in restricted mode. Inspect .vscode/ before trusting anything. ๐