Fallout in gem, Aug 24 – Aug 30

What we caught this week while monitoring over 163,363,865 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

TUESDAY

Tue Aug 25 · 2 catches · 0 waves · 2 singles
micro-behaviorsmicro-behaviors/communicationsmetadatametadata/packageobjectives/evasionmicro-behaviors/processmicro-behaviors/datamicro-behaviors/memobjectives/executionobjectivesobjectives/anti-static+2 30d
rex-powershell 0.1.102 gem 3,359,197 installs 30 days ago

Contains shellcode execution templates

eval/powershell-loadercompile/runtime
micro-behaviorsmicro-behaviors/communicationsmetadata/packagemetadatamicro-behaviors/fsobjectivesobjectives/supply-chain 30d
neat 3.0.1 gem 7,706,464 installs 30 days ago

NPM install hook exfiltrates env

credential-theft/env

MONDAY

Mon Aug 24 · 1 catch · 0 waves · 1 single
well-knownwell-known/libmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/buildmicro-behaviors/processmicro-behaviors/fsmicro-behaviors/datamicro-behaviors/osmicro-behaviors/ui+1 30d
spork 0.9.2 gem 10,440,013 installs 30 days ago

embedded reverse shell in dependency

depends on hostile gem: selenium-webdriver v0.2.2
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories