SlowMist has identified a malicious GitHub repository named "sol-live" disguised as a Solidity interview practice project that contains sophisticated data-stealing backdoors. The malware features three core modules capable of harvesting browser login databases, wallet extension storage data, macOS Keychain files, and scanning local directories for uploads. Additional capabilities include remote command execution, interactive Shell access, and clipboard monitoring. On macOS and Linux systems, the attack requires users to actively launch the malicious terminal configuration, while the Windows attack chain remains unconfirmed. SlowMist also discovered eight other GitHub projects employing similar terminal download-and-execute techniques, highlighting an emerging trend of developer-targeted supply chain attacks within the blockchain ecosystem.