OOB exfiltration of system info
host-profile/httphost-profile/victim
Fallout in javascript, Aug 24 – Aug 30
What we caught this week while monitoring over 163,107,774 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Aug 30 · 9 catches · 0 waves · 3 singlesObfuscated backdoor with C2 and self-update
backdoor/whalenttrojanized/package
Remote AI CLI control backdoor
dispatch/websocketservice/systemd
AI CLI remote-control backdoor
disk/mass-deletedispatch/websocket
SATURDAY
Sat Aug 29 · 3 catches · 0 waves · 3 singlesSpawns detached Node with decrypted payload
library/sourcehidden-payload/runtime
preinstall exfiltrates system info
oast/host-profileimpersonation/depconf
FRIDAY
Fri Aug 28 · 15 catches · 0 waves · 3 singlespreinstall exfiltrates system info
dns/encodedscripts/local-script
binding.gyp executes OS command
exploit/sandbox-escapehidden-payload/eval
binding.gyp executes OS command
exploit/sandbox-escapehidden-payload/eval
THURSDAY
Thu Aug 27 · 21 catches · 1 wave · 3 singlesTrojanized npm phishing facade
trojanized/packagemanifest/facade
Obfuscated crypto-stealer payload
blockchain/ethereumdelivery/blockchain
obfuscated dynamic import, fake error exit
anti-analysis/self-terminatehidden-payload/runtime
obfuscated remote-updating agent backdoor
backdoor/whalentremote-command/control
postinstall beacon exfiltrates hostname
package/manifestmanifest/skeleton
WEDNESDAY
Wed Aug 26 · 3 catches · 0 waves · 3 singlesobfuscated payload execution in dependency
Obfuscated backdoor with C2 and self-update
backdoor/whalentremote-command/control
Dependency clay-server classified hostile
TUESDAY
Tue Aug 25 · 7 catches · 0 waves · 3 singlesEmbedded offensive security tooling
Portproxy/CommandMimikatz/Strings
Cybersecurity tool with offensive capabilities
SUSPICIOUS/UsndeletejournalCAPE/Eternalromance
obfuscated C2, credential theft, persistence
execution/network-stagefiles/included
MONDAY
Mon Aug 24 · 37 catches · 3 waves · 3 singlescredential theft via remote relay
theft/harvested-storecredential-theft/package
Relays Facebook credentials to third-party server
theft/harvested-storecredential-theft/package
Credential stealer with install hook
credential-theft/packagecredential/browser
DNS exfiltration in preinstall hook
fingerprint/hardware
obfuscated wasm payload, typosquatting
debugger-detect/checkstring/array
Install hooks exfiltrate system data
scripts/lifecyclepackage/scoring
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories