400-font task hunt · September 7, 2026 UTC

A task match is the start.

GitHub reported 126 matches. Two pages returned one overlapping row, leaving 125 unique repositories reviewed and one reported result unaccounted for. This is a dated audit, not an exhaustive inventory.

All 125 pinned trees were retrieved without truncation and matched the indexed task blob. Four task targets contain the known wallet and resolver/execution strings. Those four join the reviewed campaign register. Missing targets and parser no-matches do not establish that a repository is clean.

Repeat the search

path:.vscode/tasks.json "folderOpen" "fa-solid-400.woff2"

Open GitHub search ↗

REST query:

"folderOpen" "fa-solid-400.woff2" filename:tasks.json

Where the parser stops

Seventeen payload-bearing results remain unresolved by the bounded static parser. Some older loaders assemble strings from fragments or use other packing schemes. Their decoding functions were not executed. A commented research task and a security test fixture are classified separately.

The collector supports five additional, reviewed task byte patterns, including fonts and fontawesome paths and nested workspace folders. New or changed task bytes remain unsupported until reviewed. Identical task content alone does not identify malicious payload bytes.

All retrieved results

Filter repositories

125 repositories

Observed 2026-09-07T01:04:49.277Z. Evidence establishes content at linked commits. Prior reporting for the four additions has not been checked; these are new to this register, with no claim of globally new indicators.

Download audit JSON ↓ · Original 500-font audit → · Collection status → · Reviewed register →