Void Dokkaebi is a malware campaign that spreads via code repositories using social engineering lures such as fake job interviews. It has been confirmed to infect macOS, although prior technical details focused on Windows, including a batch script for commit tampering. A user report describes suspicious commits coinciding with VS Code Copilot agent sessions, raising questions about whether the agent was compromised or if tampering occurred at the OS level. The user seeks forensic guidance on detecting unauthorized git amend and force push operations and on locating VS Code Copilot logs on macOS. No official vendor advisories or patches are referenced.

The malware can lead to unauthorized code injection into repositories, potentially compromising software supply chains and developer environments. The macOS infection vector and mechanisms remain partially unclear, complicating detection and response. There is no evidence of widespread exploitation or confirmed involvement of VS Code Copilot agent beyond user suspicion. The impact is medium severity due to potential codebase compromise and difficulty in attribution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fixes or mitigations are documented, defenders should monitor for unusual git commit amendments and force pushes, especially those not initiated by authorized users. Investigate VS Code logs for anomalous agent activity, although current logs may not capture detailed Copilot agent writes. Maintain vigilance on repository integrity and consider restricting automated agent permissions until more is known.