malicious dependency htmlescape
Fallout in go, Aug 17 – Aug 23
What we caught this week while monitoring over 163,411,591 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Aug 23 · 3 catches · 0 waves · 3 singlesSQL injection exploitation tool
reverse-shell/dupoffensive/commix
Embedded PHP webshell in test data
PHP/Generic
SATURDAY
Sat Aug 22 · 2 catches · 0 waves · 2 singlesObfuscated Lua payload, masquerading executables
hidden-payload/execcode-metrics/structure
FRIDAY
Fri Aug 21 · 6 catches · 0 waves · 3 singlesTrojanized library sends input to raw-IP
library/sourcellm/override
HTTP desync probe in dependency
HTTP desync probe in dependency
THURSDAY
Thu Aug 20 · 7 catches · 0 waves · 3 singlesHostile dependency flow-bin
Container escape exploit toolkit
pack/detectreverse-shell/dup
Hostile dependency [email protected]
depends on hostile npm: htmlescape v1.1.1http/message
WEDNESDAY
Wed Aug 19 · 10 catches · 0 waves · 3 singlesDownloads and executes remote PowerShell
OR/Downloadinstruction/junk-insertion
Hostile dependency: HTTP desync probe
Embedded malicious HTTP desync probe
hidden-payload/runtime
C2 beacon and reverse shell generator
reverse-shell/dupreverse-shell/pty
TUESDAY
Tue Aug 18 · 26 catches · 0 waves · 3 singlesmalicious htmlescape dependency
Android accessibility overlay keylog permissions
manipulation/corekeylog/capture
postinstall IP beacon, git diff exfil
disk/devicetrojanized/package
MONDAY
Mon Aug 17 · 40 catches · 0 waves · 3 singlesDownloads and executes hidden PowerShell payload
OR/Downloadinstruction/junk-insertion
HTTP desync probe in dependency
Hostile dependency: HTTP desync probe
depends on hostile gem: http_parser.rb v0.8.1cmd/injection
dependency contains secret exfiltration
token/cli
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories