Fallout in javascript, this week

What we caught this week while monitoring over 155,936,774 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

TODAY

Tue Sep 22 · 4 catches · 0 waves · 3 singles
well-known/appwell-knownmicro-behaviors/communicationsmetadata/binarymetadataobjectives/anti-analysisobjectives/collectionmicro-behaviorsmicro-behaviors/processobjectives/anti-staticobjectives+31 3h
polyrouter 1.0.38 javascript ✓ 3 hours ago

MITM proxy intercepts AI traffic

eval/requirecreate/hidden
micro-behaviors/communicationsmicro-behaviorsmetadata/importmetadataobjectives/supply-chainobjectives/discoverymicro-behaviors/fsmicro-behaviors/processmicro-behaviors/osobjectives/exfiltrationobjectives+1 4h
cisco-github-simple 1.0.1 javascript ✓ 4 hours ago

Exfiltrates system data to attacker server

stealer/httpoob/callback
micro-behaviors/osmicro-behaviorsmetadata/packagemetadataobjectives/anti-staticmicro-behaviors/datamicro-behaviors/processmicro-behaviors/communicationsobjectivesobjectives/exfiltrationobjectives/supply-chain 4h
@user-services/web-components 9.9.10 javascript ✓ 4 hours ago

Obfuscated C2 beacon in install hook

recon-exfil/dnsdns/encoded

YESTERDAY

Mon Sep 21 · 10 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadataobjectives/exfiltrationobjectivesobjectives/command-and-controlobjectives/supply-chain 1d
@nimbsuedge3/xar 1.1.1 javascript and 2 siblings biggest campaign ✓ 1 day ago

preinstall reverse shell C2

scripts/remote-fetchreverse-shell/dev-tcp
micro-behaviors/communicationsmicro-behaviorsmetadata/importmetadataobjectives/command-and-controlobjectives/anti-staticobjectives/executionobjectives/impactobjectives/evasionobjectivesmicro-behaviors/process+11 18h
cortico-world-pvz 0.1.2 javascript 18 hours ago

Process injection and code patching

injection/dllinjection/memory
well-knownwell-known/librarymicro-behaviors/communicationsmicro-behaviorsmetadata/importmetadataobjectives/supply-chainobjectives/command-and-controlobjectives/lateral-movementobjectives/anti-staticobjectives+9 1d
lynxog 4.0.0 javascript 1 day ago

obfuscated WhatsApp bot with remote code execution

string/encodingstring/concat
micro-behaviors/communicationsmicro-behaviorsmalware/librarymalwaremetadatametadata/buildobjectives/impactobjectives/supply-chainobjectives/command-and-controlobjectivesobjectives/credential-access+17 1d
@agenttrail/guard 0.1.0 javascript 1 day ago

Ransomware and credential theft code

dropper/obfuscatedtoken/cli
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories