Fallout in github, Aug 24 – Aug 30

What we caught this week while monitoring over 163,107,774 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

TUESDAY

Tue Aug 25 · 1 catch · 0 waves · 1 single
objectives/anti-staticobjectiveswell-knownwell-known/appmicro-behaviors/communicationsmicro-behaviorsmetadata/buildmetadataobjectives/supply-chainobjectives/collectionobjectives/command-and-control+15 29d
sattyamjjain/agent-audit-kit v0.3.89 github 29 days ago

postinstall curl-pipe-shell dropper

dropper/download-executedropper/pipe-execute

MONDAY

Mon Aug 24 · 48 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsmetadatametadata/langobjectives/supply-chainobjectives/evasionobjectives/executionmicro-behaviors/dataobjectives/anti-staticobjectivesobjectives/command-and-control+3 31d
dsl2022/demo-git-2022 2022 github and 2 siblings biggest campaign 31 days ago

Malicious VSCode autorun executes hidden payload

payload/encodeddelivery/blockchain
objectives/anti-staticwell-knownwell-known/librarymicro-behaviors/communicationsmicro-behaviorsmetadatametadata/librarymicro-behaviors/dataobjectivesobjectives/supply-chainobjectives/execution+6 31d
DogukanGun/NexAI github 31 days ago

obfuscated postcss config payload

eval/dynamichidden-payload/trojan
well-knownwell-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/packageobjectives/anti-staticobjectives/evasionobjectives/command-and-controlobjectivesobjectives/supply-chain+5 31d
dsl2022/aws-solution-architect-practice github 31 days ago

EtherHiding malware in disguised font file

delivery/blockchaininstall-hook/tasks
micro-behaviors/communicationsmicro-behaviorsmetadatametadata/importobjectives/anti-staticobjectives/evasionmicro-behaviors/datamicro-behaviors/processobjectives/command-and-controlobjectivesobjectives/execution+5 31d
dsl2022/nyu-sd-07-a-class 07-a-class github 31 days ago

Malicious crypto drainer payload

delivery/blockchaintrigger/ide
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories