Fallout in comfyui, this week

What we caught this week while monitoring over 189,646,476 artifacts across 59 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

MONDAY

Mon Sep 28 · 2 catches · 0 waves · 2 singles
well-known/librarywell-knownmicro-behaviors/processmicro-behaviorsmetadata/buildmetadataobjectives/command-and-controlobjectives/supply-chainobjectives/anti-staticobjectives/executionobjectives+22 2d

obfuscated exec payload in _xzg_tool

interpreter/pythonstring/reverse
micro-behaviors/processmicro-behaviorsmalware/librarymetadata/buildmalwaremetadataobjectives/command-and-controlobjectives/supply-chainobjectives/anti-staticobjectives/executionobjectives+22 2d

Obfuscated payload with crypto imports

interpreter/pythonobfuscator/js-obfuscator
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories