Malicious postinstall downloads and executes payload
dropper/windows-loaderinstall-hook/hook-only
Fallout in javascript, Aug 10 – Aug 16
What we caught this week while monitoring over 163,443,884 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Aug 16 · 23 catches · 0 waves · 3 singlesobfuscated preinstall exfiltration payload
eval/loaderhidden/execution
Embedded Xelis cryptominer in npm package
miner/runtimeobfuscator/js-obfuscator
Browser cookie theft, keylogging, stealth
browser/chromiumscreenshot/capture
SATURDAY
Sat Aug 15 · 41 catches · 0 waves · 3 singlesExfiltrates ECS metadata via postinstall
recon-exfil/install-hookcredential/token
postinstall exfiltrates data via curl
oob/endpointscripts/postinstall
Obfuscated dropper, C2, persistence
hidden/executionencoding/arithmetic
obfuscated C2 terminal agent
dispatch/websocketsystem/package-manager
FRIDAY
Fri Aug 14 · 159 catches · 8 waves · 3 singlesTea campaign supply chain malware
supply-chain/tea-reward
Tea campaign supply-chain malware
supply-chain/pem-misasupply-chain/metadata-anomaly
obfuscated dropper with self-deletion
script/dropperobfuscation/multi-layer
Tea campaign supply chain malware
supply-chain/tea-reward
Credential exfiltration via install hooks
http/uploadoob/endpoint
Tea campaign supply chain malware
supply-chain/tea-reward
Sandbox-gated remote code execution
delivery/fetch-evalencoding/content
C2 beacon, removed package, preinstall hook
backdoor/browser
Malicious postinstall beacon
recon-exfil/install-hookimpersonation/depconf
THURSDAY
Thu Aug 13 · 70 catches · 2 waves · 3 singlespostinstall exfiltrates host data
impersonation/depconfrecon-exfil/install-hook
Dependency confusion staging URL
package/direct-urlmanifest/placeholder
preinstall exfiltrates host data to OOB
manifest/placeholderpackage/direct-url
install hook exfiltrates environment
install-hook/agentcredential-theft/env
obfuscated postinstall dropper
install-hook/remote-binarydropper/runtime
Embedded protestware payload in SweetAlert2
manipulation/browserunwanted/sweetalert2-protestware
WEDNESDAY
Wed Aug 12 · 84 catches · 1 wave · 3 singlesDropper downloads and executes DDoS tools
install-hook/remote-binaryinstall-hook/hook-only
postinstall exfiltrates host data to C2
build/behavioralscripts/postinstall
postinstall exfiltrates system info
http/queryrecon-exfil/install-hook
Exfiltrates system data to remote server
install-hook/hook-onlypackage/manifest
postinstall exfiltrates command output
http/queryrecon-exfil/install-hook
TUESDAY
Tue Aug 11 · 94 catches · 3 waves · 3 singlesObfuscated WMI execution, hidden process
execution/wmi
Credential stealer with OOB exfil
credential/multi-sourcehttp/upload
Supply chain trojan exfiltrates credentials
theft/multi-storehttp/upload
Obfuscated WScript file dropper
obfuscation/multi-layerobfuscation/syntax
Obfuscated PowerShell dropper with persistence
script/wshobfuscation/syntax
Obfuscated dropper, kills processes, hidden PowerShell
obfuscation/syntaxscript/wsh
MONDAY
Mon Aug 10 · 68 catches · 0 waves · 3 singlesObfuscated WSH dropper, C2 IP, PowerShell bypass
execution/persistencescript/dropper
Obfuscated dropper with file write
obfuscation/multi-layerobfuscation/syntax
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories