A dropper that runs on folder-open, and why your blocklist never sees it

The two hiding tricks are aimed at different readers. A file in `public/fonts/` is not opened by anyone reviewing a diff, and this one is not a font: it begins with 507 spaces where a real WOFF2 begins with the bytes `wOF2` ^[5]. The `postcss.config.js` is aimed at the person who does open the file. It renders as four correct lines of Tailwind plugin config and weighs 9,205 bytes, because line five runs 9,135 characters past the closing brace, mostly spaces, then payload ^[6]. That is about 99 percent of the file sitting off the right edge of an unwrapped pane ^[17]. Five months of dwell time on one sample ^[2], per the field guide published on dev.to, is what that buys.

Read the task flags rather than the label: `hide: true`, `reveal: never`, `echo: false`, and `runOn: folderOpen`, which is what makes the editor the trigger ^[3]. What it executes is `node ./public/fonts/fa-solid-400.woff2` ^[4]. A developer who never opens the folder in VS Code is not out of it either, because Next.js `require()`s the postcss config on every `next dev` and `next build` ^[7].

The loader carries no server address at all ^[8]. It reads the newest outbound transaction from a hardcoded wallet through Blockscout, then decodes the first eight bytes of the 20-byte destination address into a primary and a fallback IPv4 address ^[9]. Eight of twenty bytes used, twelve ignored ^[18]: there is room in that field for more than the operator currently needs. Cutting off one RPC provider does nothing, because the resolution falls through four of them ^[8]. And the stage-two fetch is plain HTTP pointed at port 443 ^[10], so an egress rule written around port numbers rather than protocols has nothing to object to.

The four suggested checks ^[14] have a sequencing problem worth naming. Grepping `.vscode/tasks.json` for `folderOpen` requires the clone to be on disk, which means fetch and inspect must happen before the editor is ever pointed at the directory. Once it has run, `spawn` with `detached: true` followed by `unref()` reparents the process to init, so it outlives the editor that started it ^[12]; quitting VS Code is not a remedy, and the `ps` check is the only one of the four that finds a live loader ^[14]. The wallet grep, including the history pass, catches this operator only, since deleting the file does not remove it from Git ^[16].

The observed payload polls the clipboard every 200 ms ^[13]. That is five reads a second, 18,000 an hour ^[19]. A token pasted once into a terminal on that machine is captured whether or not it has anything to do with the repository.