Typosquatting, HTTP deps, fake author
package/direct-urldependencies/direct-url
Fallout in javascript, Aug 31 – Sep 6
What we caught this week while monitoring over 163,052,840 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Sep 6 · 746 catches · 62 waves · 3 singlesRemote control, persistence, credential access
Embedded credential exfiltration payloads
recon-exfil/pipelinesecrets/source-control
Downloads and executes remote binaries
dns/tunnelinglibrary/source
OOB exfiltration via preinstall hook
scripts/lifecyclepackage/scoring
OOB beacon, fake version, preinstall
package/scoringscripts/lifecycle
Downloads and executes remote payload
dns/tunnelinglibrary/source
Clipboard exfiltration, screen capture, input injection
clipboard/monitorscreenshot/capture
Exfiltrates credentials to OOB server
scripts/lifecyclepackage/scoring
OOB exfiltration and install hooks
package/scoringbuild/behavioral
OOB exfil, fake version, install hooks
package/manifestbuild/behavioral
Exfiltrates environment variables to OOB
package/scoringscripts/lifecycle
Exfiltrates environment variables to OOB
scripts/lifecyclepackage/scoring
Exfiltrates credentials to OOB server
package/scoringscripts/lifecycle
Exfiltrates env data via webhook
scripts/lifecyclepackage/scoring
Exfiltrates system data to OOB
package/scoringscripts/lifecycle
postinstall downloads and executes remote code
delivery/download-executescripts/dynamic-install
Exfiltrates system data via webhook
package/manifestoob/oast
Exfiltrates credentials to OOB server
scripts/lifecyclepackage/scoring
Exfiltrates host info to webhook.site
scripts/lifecycleoob/oast
Downloads and executes remote payload
dns/tunnelinglibrary/source
Exfiltrates system info to OOB
scripts/lifecycleoast/secret
Exfiltrates secrets via install hook
scripts/lifecyclequality/version-sentinel
preinstall exfiltrates system info
build/behavioralregistry/lifecycle
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Preinstall exfiltrates system info
scripts/lifecycleoast/host-profile
Remote agent, persistence, bypass permissions
dispatch/websockethidden-payload/native-extension
Preinstall exfiltrates system info
build/behavioralscripts/lifecycle
Downloads and executes remote payload
library/sourcedns/tunneling
Downloads and executes remote binary
library/sourcedns/tunneling
Exfiltrates environment variables to OOB
scripts/lifecycleoob/oast
Exfiltrates system info to OOB
package/scoringpackage/manifest
SSH key exfiltration, C2 beacon
ssh/keyscripts/postinstall
Downloads and executes remote binary
dns/tunnelinglibrary/source
Exfiltrates system info to OOB
scripts/lifecyclehost-profile/victim
Exfiltrates system data via OOB
fingerprint/hardwarehttp/upload
Full-screen ad overlay injection
manipulation/coreui/delivery
Exfiltrates system info to OOB
package/manifestoob/oast
Trojanized dependency with hidden loader
library/hidden-depimpersonation/npm-clone
Trojanized package with malicious dependency
impersonation/npm-clonelibrary/hidden-dep
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
TikTok scraper with C2 and evasion
trojanized/package
Bytecode obfuscation, CDP, shell exec
control/hvncobfuscation/syntax
Discord token stealer
credential/discorddiscord/token
Exfiltrates Discord tokens to webhook
scripts/dynamic-installcredential/multi-source
TikTok scraper with C2 and evasion
trojanized/package
Remote code execution via eval
infrastructure/pastetrigger/activation
Game cheat with process injection
script/wshdelivery/download-execute
Game cheat with process injection
script/wshinjection/dll
Exfiltrates system info via install hooks
scripts/lifecyclebuild/behavioral
Bundled RedShell backdoor binary
fileless/memoryhttp/archive
EtherHiding crypto drainer payload
obfuscator/js-obfuscatorpayload/encoded
Remote code execution via base64
supply-chain/property-demoinfrastructure/paste
Exfiltrates SSH keys, env, Telegram data
stealer/trader-traitor
Obfuscated credential stealer
stealer/workflowdropper/standalone
AI agent remote control tool
dispatch/websockethidden-payload/native-extension
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Remote code execution, C2, obfuscation
infrastructure/pasteeval/require
preinstall downloads and executes remote code
dropper/download-executebuild/behavioral
Obfuscated malware in preinstall hook
dropper/obfuscationJS/Obfuscatorio
Exfiltrates system info via install hooks
scripts/lifecyclebuild/behavioral
Obfuscated session wipe and data exfil
destroy/file-deletion
SATURDAY
Sat Sep 5 · 6 catches · 0 waves · 3 singlesRemote AI agent control binary
dispatch/websockethidden-payload/native-extension
Remote AI CLI control agent
dispatch/websockethidden-payload/native-extension
obfuscated self-updating backdoor agent
backdoor/whalenttrojanized/package
FRIDAY
Fri Sep 4 · 5534 catches · 447 waves · 3 singlesDownloads and executes remote binaries
library/sourcedns/tunneling
postinstall exfiltrates to webhook.site
install-hook/hook-only
Downloads and executes remote binaries
library/sourcedns/tunneling
Downloads and executes remote payloads
library/sourcedns/tunneling
Malicious ad injection and self-update
manipulation/coreui/delivery
Obfuscated credential-stealing preinstall hook
supply-chain/shai-huludhidden-payload/git-deaddrop
Exfiltrates system info to hardcoded IP
manifest/attack-labelpackage/manifest
Exfiltrates system data to C2
stealer/trader-traitor
Exfiltrates system data to OOB domain
http/uploaddns/tunnel
Trojanized package with obfuscated code
hidden-payload/evalForeignobject/Nov24
Downloads and executes remote binaries
dns/tunnelinglibrary/source
Preinstall exfiltrates system info to OOB
build/behavioralscripts/lifecycle
Downloads and executes remote binary
library/sourcedns/tunneling
DNS exfil, payload download, execution
dns/tunnelinglibrary/source
Downloads and executes remote binary
library/sourcedns/tunneling
Dropper downloads and executes Bun runtime
theft/multi-storedropper/standalone
Credential stealer with persistence and exfiltration
http/uploadstealer/workflow
Downloads and executes remote binaries
library/sourcedns/tunneling
Obfuscated credential-stealing preinstall payload
supply-chain/shai-huluddropper/bun
Obfuscated payload, preinstall hook, C2
install-hook/bun-bootstraptheft/multi-store
postinstall exfiltrates logs to OAST
recon-exfil/install-hook
Exfiltrates system info via install hooks
registry/lifecyclescripts/postinstall
Remote code execution via C2
infrastructure/pastedelivery/fetch-eval
C2, reverse shell, data exfiltration
reverse-shell/dupshell/spawn
Malicious backdoor with C2 and reverse shell
host-profile/socketreverse-shell/dup
Remote code execution via eval
delivery/fetch-evalinfrastructure/paste
DNS exfil, binary download, execution
dns/tunnelinglibrary/source
Remote agent bypasses permissions
dispatch/websockethidden-payload/native-extension
Exfiltrates system info to OOB
scripts/lifecyclehost-profile/victim
Self-referential dependency, remote code execution
scripts/dynamic-installinstall-hook/remote-binary
Downloads and executes remote payload
library/sourcedns/tunneling
preinstall exfiltrates system data
recon-exfil/install-hookhttp/report
Obfuscated malware with credential theft
supply-chain/shai-huludhidden-payload/git-deaddrop
Malicious dependency exfiltrates data
http/uploadscripts/lifecycle
Exfiltrates system info via install hooks
package/manifestmanifest/attack-label
Exfiltrates AWS credentials via OOB
manifest/attack-labelscripts/lifecycle
Embedded Shai-Hulud malware payload
Compromise/Sep25dropper/bun
Exfiltrates secrets via install hook
scripts/lifecyclequality/version-sentinel
Downloads and executes remote payload
library/sourcedns/tunneling
npm postinstall credential harvester
theft/multi-storelibrary/module-init
Preinstall hook exfiltrates system info
build/behavioralscripts/lifecycle
Exfiltrates system info to OOB
scripts/lifecyclehost-profile/victim
preinstall exfiltrates host identity via OOB
impersonation/depconfpackage/direct-url
preinstall exfiltrates host data via OOB
impersonation/depconfpackage/direct-url
Dropper downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Browser credential and wallet stealer
theft/multi-storelibrary/module-init
Credential theft and email harvesting
scan/utilityhost/software
Malicious C2 and privilege escalation
recon-exfil/npm-install-targetingscript/dropper
Malicious install hook executes payload
dropper/targeted
Malicious install hook executes hidden PowerShell
dropper/targeted
Exfiltrates secrets to webhook.site
Compromise/Sep25credential/multi-source
Downloads and executes remote binary
dns/tunnelinglibrary/source
Exfiltrates email via postinstall
recon-exfil/npm-install-targetingpackage/manifest
postinstall executes remote code
delivery/fetch-evaldropper/runtime
UAC bypass, C2 beacon, data exfil
library/frameworkscript/embedded
Exfiltrates system data to hardcoded IP
quality/version-sentinelscripts/lifecycle
Obfuscated C2 beaconing to malicious domain
recon-exfil/dnsobfuscation/imports
preinstall executes remote code
delivery/fetch-eval
Downloads and executes remote payload
dns/tunnelinglibrary/source
Exfiltrates system data to OOB
oob/endpointoob/oast
Typosquat of big.js with trojanized security-hold dependency
impersonation/npm-clonelibrary/hidden-dep
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
Downloads and executes remote binary
library/sourcedns/tunneling
Steals wallets, history, exfiltrates data
credential/multi-sourcestealer/workflow
Exfiltrates secrets to hardcoded IP
infrastructure/ip-portcredential-theft/env
Game cheat with process injection
script/wshdelivery/download-execute
Game cheat with process injection
script/wshdelivery/download-execute
Preinstall exfiltrates system info
scripts/lifecycleoast/env
Remote code execution via postinstall
supply-chain/property-demotrigger/activation
Exfiltrates system info to webhook.site
oob/oastpackage/manifest
Base64 obfuscated malicious install command
scripts/dynamic-installdelivery/download-execute
SSH key injection, data exfiltration
stealer/trader-traitorstealer/system-info
Embedded Shai-Hulud malware payload
Compromise/Sep25install-hook/bun-bootstrap
preinstall hook executes arbitrary code
package/manifestautoinstall/package
Preinstall hook executes remote code
delivery/fetch-evalhidden-payload/eval
Dynamic code execution, C2 IP
credential-theft/packageeval/require
SSH key injection, data exfiltration
stealer/trader-traitor
Exfiltrates system info to hardcoded IP
recon-exfil/install-hookpackage/manifest
Obfuscated payload, preinstall downloads/executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Exfiltrates environment via preinstall
package/manifestbuild/behavioral
Trojanized dependency with hidden loader
impersonation/npm-clonelibrary/hidden-dep
Exfiltrates sensitive data to remote server
credential/multi-sourcestealer/workflow
Exfiltrates secrets via Telegram
scripts/hook-filepackage/manifest
Credential stealer and dropper
dropper/standaloneapi-harvest/token
Exfiltrates system info to OOB
scripts/lifecyclehost-profile/victim
postinstall exfiltrates environment data
package/manifestmanifest/attack-label
Exfiltrates credentials, executes remote commands
host-profile/victimstealer/system-info
Exfiltrates secrets to webhook.site
Compromise/Sep25install-hook/bun-bootstrap
DNS exfil, binary download, execution
library/sourcedns/tunneling
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall hook exfiltrates system info
oob/oastscripts/lifecycle
Exfiltrates system info via preinstall
scripts/lifecyclebuild/behavioral
Exfiltrates system data to OOB
package/manifestlibrary/framework
Embedded Shai-Hulud malware payload
Compromise/Sep25install-hook/bun-bootstrap
Downloads and executes remote payload
execution/stealth-spawn
Exfiltrates system data to C2
install-hook/hook-onlypackage/manifest
Exfiltrates secrets via preinstall hook
credential/envcredential-theft/package
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Exfiltrates system credentials and files
stealer/filehidden-payload/exec
Remote code execution via eval
delivery/fetch-evalstealer/beaver-tail
Exfiltrates system credentials and data
stealer/filehidden-payload/exec
preinstall exfiltrates .env to Telegram
manifest/attack-labelpackage/manifest
DNS C2, payload download, execution
library/sourcedns/tunneling
Token harvester, exfiltrates secrets
theft/multi-storelibrary/module-init
Exfiltrates secrets to webhook.site
Compromise/Sep25install-hook/bun-bootstrap
Obfuscated dropper executes downloaded payload
dropper/standalonetheft/multi-store
Exfiltrates files via webhook.site
scripts/lifecyclepackage/direct-url
Credential theft and exfiltration malware
credential/httphttp/upload
Base64 obfuscated malicious install command
scripts/dynamic-installdelivery/download-execute
Exfiltrates secrets to webhook.site, spawns detached scripts, republishes packages
Compromise/Sep25credential/multi-source
Embedded Shai-Hulud malware payload
Compromise/Sep25dropper/bun
Remote code execution and persistence
tasking/http-command
Exfiltrates secrets to webhook.site
Compromise/Sep25install-hook/bun-bootstrap
Exfiltrates secrets via postinstall hook
oob/endpointexfiltration/sensitive-data
Downloads and executes remote binary
execution/native-binarydns/tunneling
preinstall exfiltrates system info
scripts/lifecycleexfiltration/file-upload
Exfiltrates credentials, deploys malware
recon-exfil/pipelinecredential/env
Obfuscated credential stealer and dropper
dropper/standalonestealer/workflow
Downloads and executes remote payload
library/sourcedns/tunneling
Dependency confusion exfiltration POC
package/manifestmanifest/attack-label
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall runtime download
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Obfuscated payload, preinstall downloads/executes Bun
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall Bun dropper
theft/multi-storedropper/standalone
Obfuscated payload, preinstall runtime download
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
Dropper downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Obfuscated payload, preinstall Bun dropper
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated payload, preinstall Bun dropper
dropper/standalonetheft/multi-store
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall downloads/executes Bun
install-hook/bun-bootstrapdropper/standalone
Obfuscated payload, preinstall downloads/executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall runtime download
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated payload, preinstall downloads/executes Bun
install-hook/bun-bootstraptheft/multi-store
Obfuscated payload, preinstall downloads/executes Bun
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes Bun
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall runtime download
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated payload, preinstall runtime download
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Obfuscated payload, preinstall runtime download
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
Obfuscated payload, preinstall runtime download
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall downloads/executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall Bun dropper
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall downloads/executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall runtime download
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
Obfuscated payload, Bun dropper, preinstall
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
Downloads and executes hidden Bun runtime
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated dropper downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall Bun dropper
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall downloads/executes Bun
install-hook/bun-bootstrapdropper/standalone
Downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Preinstall drops obfuscated credential-stealing payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Obfuscated payload, preinstall downloads/executes Bun
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall Bun download
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall runtime download
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated payload, downloads and executes Bun runtime
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes Bun
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated dropper downloads and executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstrapdropper/standalone
Obfuscated credential theft during install
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Obfuscated payload, preinstall runtime download
install-hook/bun-bootstrapdropper/standalone
Obfuscated payload, preinstall runtime download
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall Bun dropper
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall Bun dropper
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall downloads/executes Bun
theft/multi-storedropper/standalone
Obfuscated payload, preinstall Bun dropper
dropper/standalonetheft/multi-store
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall Bun dropper
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall runtime download
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Downloads and executes obfuscated payload
theft/multi-storedropper/standalone
Credential stealer and C2 exfiltration
dropper/standalonestealer/workflow
postinstall drops and runs encoded stealer
credential/browserwallet/desktop
Credential stealer with obfuscation
api-harvest/tokendropper/standalone
Obfuscated payload, preinstall Bun dropper
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
Obfuscated dropper executes hidden payload
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Obfuscated payload, preinstall hook, C2
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
Downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall hook, C2
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, runtime download, preinstall hook
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
package/direct-urltheft/multi-store
preinstall downloads and executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
Obfuscated preinstall credential stealer
supply-chain/shai-huluddropper/bun
Downloads and executes remote payload
dns/tunnelingdelivery/execute-download
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated payload, preinstall Bun dropper
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall hook, C2
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated payload, preinstall hook, C2
install-hook/bun-bootstrapdropper/standalone
Obfuscated payload, preinstall hook, runtime download
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated payload, downloads and executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated dropper spawns hidden child process
delivery/fetch-evaleval/loader
Remote code execution via axios
hidden-payload/evalaes/runtime-library
preinstall hook executes obfuscated payload
supply-chain/shai-huludhidden-payload/git-deaddrop
Remote code execution via axios
supply-chain/property-demodelivery/fetch-eval
Steals credentials, exfiltrates via Telegram
scripts/hook-filesecrets/wallet
Obfuscated remote code execution
impersonation/clone-and-rename
preinstall executes hidden ELF binary
trigger/agentdropper/native-loader
Obfuscated hidden payload execution
eval/requirehidden-payload/encoding
OOB exfiltration, dependency confusion POC
oob/oastpackage/manifest
Downloads and executes remote binaries
dns/tunnelinglibrary/source
postinstall exfiltrates host recon to remote server
install-hook/hook-onlyscripts/hook-file
Obfuscated preinstall dropper spawning payload
dropper/setup-hook
Disables TLS, downloads from raw IP
dropper/native-loaderdelivery/fetch-eval
EtherHiding malware payload
obfuscator/js-obfuscatordelivery/blockchain
preinstall executes obfuscated malicious code
hidden-payload/git-deaddropsupply-chain/shai-hulud
preinstall executes obfuscated malicious payload
supply-chain/shai-huluddropper/bun
preinstall hook executes obfuscated payload
supply-chain/shai-huluddropper/bun
preinstall hook executes obfuscated payload
hidden-payload/git-deaddropsupply-chain/shai-hulud
preinstall hook, obfuscated credential theft
hidden-payload/git-deaddropdropper/bun
preinstall hook executes obfuscated payload
hidden-payload/git-deaddropsupply-chain/shai-hulud
preinstall hook executes obfuscated payload
package/direct-urlsupply-chain/shai-hulud
preinstall hook runs obfuscated payload
supply-chain/shai-huludhidden-payload/git-deaddrop
obfuscated credential-stealing malware
supply-chain/shai-huluddropper/bun
preinstall hook executes obfuscated payload
supply-chain/shai-huludhidden-payload/git-deaddrop
Obfuscated credential stealer in preinstall
supply-chain/shai-huluddropper/bun
preinstall hook executes obfuscated payload
supply-chain/shai-huluddropper/bun
preinstall executes obfuscated malicious payload
supply-chain/shai-huludhidden-payload/git-deaddrop
preinstall hook executes obfuscated malware
hidden-payload/git-deaddropsupply-chain/shai-hulud
preinstall hook executes obfuscated payload
dropper/bunsupply-chain/shai-hulud
preinstall hook executes obfuscated payload
supply-chain/shai-huluddropper/bun
preinstall executes obfuscated malware
dropper/bunsupply-chain/shai-hulud
malicious preinstall script
supply-chain/shai-huluddropper/bun
preinstall hook executes obfuscated payload
dropper/bunhidden-payload/git-deaddrop
Obfuscated preinstall credential stealer
hidden-payload/git-deaddropsupply-chain/shai-hulud
Obfuscated payload in postcss config
eval/loadereval/dynamic
Downloads and executes obfuscated payload
execution/native-binarylibrary/source
Obfuscated remote code execution
obfuscator/js-obfuscatorForeignobject/Nov24
Obfuscated install script downloads and executes payload
dropper/setup-hook
Obfuscated credential stealer in preinstall
stealer/workflowexploit/container
Obfuscated credential stealer with install hook dropper
stealer/workflowapi-harvest/token
Obfuscated credential stealer
dropper/standalonestealer/workflow
Credential stealer with obfuscation
stealer/workflowapi-harvest/token
Obfuscated credential stealer in preinstall
api-harvest/tokenstealer/workflow
Credential stealer in obfuscated router_init.js
api-harvest/tokendropper/standalone
Obfuscated credential stealer and dropper
stealer/workflowapi-harvest/token
Obfuscated credential stealer and dropper
stealer/workflowdropper/standalone
Obfuscated credential stealer and dropper
dropper/standaloneapi-harvest/token
Obfuscated credential stealer with install hook
exploit/containerstealer/workflow
Obfuscated credential stealer payload
stealer/workflowdropper/standalone
Obfuscated credential stealer and dropper
stealer/workflowdropper/standalone
Obfuscated credential stealer in preinstall
stealer/workflowdropper/standalone
Obfuscated C2 with preinstall hook
backdoor/whalentdropper/obfuscation
Whalent malware, obfuscated C2, self-update
backdoor/whalentdropper/obfuscation
Whalent backdoor, obfuscated C2, self-update
backdoor/whalentdropper/obfuscation
Obfuscated backdoor with C2 and self-update
backdoor/whalentdropper/obfuscation
Obfuscated backdoor with C2 and self-update
backdoor/whalentdropper/obfuscation
Obfuscated backdoor with C2 and self-update
backdoor/whalentdropper/obfuscation
Obfuscated backdoor with C2 and self-update
backdoor/whalentdropper/obfuscation
Malicious persistence and payload execution
hidden-payload/runtimetrojan/eth-dev
Obfuscated backdoor with C2 and self-update
backdoor/whalentdropper/obfuscation
Typosquat of bitcoinjs-lib; postinstall launches hidden bip40 daemon
impersonation/clone-and-renamescripts/hook-file
Exfiltrates secrets via webhook.site
Compromise/Sep25dropper/bun
Recon, flag theft, exfiltration to hardcoded IP
package/manifestquality/version-sentinel
Obfuscated credential theft and C2
hidden-payload/git-deaddropcreate/spawn
Embedded secret exfiltration script
Compromise/Sep25credential/multi-source
Obfuscated C2 beacon in install hook
quality/version-sentinel
Embedded Shai-Hulud malware payload
Compromise/Sep25credential/multi-source
Embedded supply chain malware payload
Compromise/Sep25dropper/bun
Obfuscated credential theft and C2
hidden-payload/git-deaddropcreate/spawn
Obfuscated credential theft and C2
hidden-payload/git-deaddropcreate/spawn
Embedded Shai-Hulud malware payload
Compromise/Sep25install-hook/bun-bootstrap
Exfiltrates secrets to webhook.site
Compromise/Sep25dropper/bun
Credential stealer disguised as Mistral SDK
dropper/standalonestealer/workflow
Obfuscated credential stealer in router_init.js
stealer/workflowapi-harvest/token
Embedded script exfiltrates GitHub secrets to webhook.site
Compromise/Sep25dropper/bun
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
Obfuscated preinstall downloads and executes payload
install-hook/bun-bootstrapdropper/standalone
Obfuscated dropper downloads and executes Bun
install-hook/bun-bootstrapdropper/standalone
Exfiltrates system info to OOB server
scripts/lifecyclehost-profile/victim
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
Obfuscated dropper downloads and executes Bun
theft/multi-storedropper/standalone
Obfuscated dropper downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Dropper downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated dropper downloads and executes Bun
dropper/standalonetheft/multi-store
Credential stealer, obfuscated, self-daemonizing
dropper/standaloneapi-harvest/token
Steals credentials, obfuscated, drops runtime
dropper/standaloneapi-harvest/token
obfuscated dropper downloads and executes payload
theft/multi-storedropper/standalone
obfuscated dropper downloads and executes payload
install-hook/bun-bootstrapdropper/standalone
Obfuscated dropper downloads and executes Bun
install-hook/bun-bootstrapdropper/standalone
Obfuscated dropper downloads and executes Bun
dropper/standalonetheft/multi-store
Obfuscated AWS credential theft
theft/multi-storeinstall-hook/credential
Obfuscated credential stealer payload
theft/multi-storeinstall-hook/credential
Obfuscated dropper downloads and executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated credential stealer and dropper
api-harvest/tokenstealer/workflow
Trojanized dependency easy-day-js
trojanized/hidden-dependencysupply-chain/metadata-anomaly
Exfiltrates secrets to webhook.site
Compromise/Sep25dropper/bun
Exfiltrates secrets to webhook.site
Compromise/Sep25dropper/bun
Exfiltrates secrets to webhook.site
Compromise/Sep25install-hook/bun-bootstrap
Exfiltrates secrets to webhook.site
Compromise/Sep25dropper/bun
Exfiltrates secrets to webhook.site
Compromise/Sep25dropper/bun
Embedded secret exfiltration script
Compromise/Sep25install-hook/bun-bootstrap
Exfiltrates secrets to webhook.site
Compromise/Sep25credential/multi-source
Shai-Hulud worm payload embedded
worm/registryCompromise/Sep25
Exfiltrates secrets to webhook.site
Compromise/Sep25credential/multi-source
Shai-Hulud worm payload embedded
worm/registryCompromise/Sep25
Obfuscated agent, CDP, shell exec, install hooks
obfuscation/syntaxcontrol/hvnc
Embedded secret exfiltration script
Compromise/Sep25credential/multi-source
Shai-Hulud worm exfiltrates secrets
Compromise/Sep25worm/registry
Shai-Hulud worm payload embedded
supply-chain/shai-huludCompromise/Sep25
Exfiltrates secrets to webhook.site
Compromise/Sep25install-hook/bun-bootstrap
preinstall dropper executes obfuscated credential-stealing payload
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated data exfiltration to hardcoded IP
obfuscator/js-obfuscatorstring/encoding
curl piped to zsh C2 dropper
execution/native-binarydelivery/pipe
Preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
Obfuscated DNS exfiltration with preinstall hook
dropper/setup-hookscripts/lifecycle
Obfuscated payload, preinstall executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
Preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
Downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall dropper runs obfuscated credential-stealing payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated dropper downloads and executes Bun
dropper/standalonetheft/multi-store
Preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated dropper downloads and executes Bun
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
Downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
Downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
Exfiltrates secrets to webhook.site
Compromise/Sep25credential/multi-source
Downloads and executes remote binaries
string/conceallibrary/source
Downloads and executes remote payload
dns/tunnelingexecution/native-binary
Credential harvesting and exfiltration
recon-exfil/pipelinetheft/multi-store
Obfuscated malicious npm package
hidden-payload/stagingdelivery/download-execute
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
Embedded secret exfiltration script
Compromise/Sep25install-hook/bun-bootstrap
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
Exfiltrates secrets to webhook.site
Compromise/Sep25credential/multi-source
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
Embedded secret exfiltration script
Compromise/Sep25install-hook/bun-bootstrap
preinstall exfiltrates to oastify
scripts/lifecyclepackage/manifest
Exfiltrates credentials via preinstall hook
credential/dev-filepackage/manifest
Ignores malware scanners, hides code in bytecode
control/hvnchidden-payload/scanner-blind
Exfiltrates system data to webhook
http/uploadoob/endpoint
Exfiltrates secrets to webhook.site
Compromise/Sep25credential/multi-source
Embedded secret exfiltration script
Compromise/Sep25credential/multi-source
preinstall executes remote shell
scripts/lifecycle
Embedded secret exfiltration script
Compromise/Sep25install-hook/bun-bootstrap
Embedded secret exfiltration script
Compromise/Sep25dropper/bun
Embedded secret exfiltration script
Compromise/Sep25credential/multi-source
Bundle contains secret exfiltration script
Compromise/Sep25install-hook/bun-bootstrap
Embedded secret exfiltration script
Compromise/Sep25dropper/bun
Embedded Shai-Hulud malware payload
Compromise/Sep25dropper/bun
Embedded secret exfiltration script
Compromise/Sep25dropper/bun
THURSDAY
Thu Sep 3 · 138 catches · 19 waves · 3 singlesDownloads and executes obfuscated payload
dns/tunnelinglibrary/source
Typosquat with reverse shell and exfiltration
manifest/skeletonreverse-shell/dup
Trojanized package with hidden dependency
library/hidden-depimpersonation/npm-clone
Exfiltrates environment variables via install hooks
package/manifestmanifest/attack-label
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Downloads and executes obfuscated payload
library/sourcedns/tunneling
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Disables TLS, downloads from raw IP
dropper/native-loaderdelivery/fetch-eval
obfuscated dropper downloads and executes payload
theft/multi-storedropper/standalone
Downloads and executes remote payload
library/sourcedns/tunneling
Downloads and executes obfuscated payload
library/sourcedns/tunneling
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
obfuscated dropper downloads and executes payload
install-hook/bun-bootstrapdropper/standalone
Downloads and executes remote binary
dns/tunnelinglibrary/source
Preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Obfuscated dropper downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Obfuscated self-defending dist with eval, child_process, OAuth tokens
obfuscator/js-obfuscatorstring/array
obfuscated backdoor with self-update
backdoor/whalentremote-command/control
Exfiltrates Coze API tokens and data
recon-exfil/install-hookpackage/manifest
WEDNESDAY
Wed Sep 2 · 47 catches · 1 wave · 3 singlesObfuscated payload execution via new Function
payload/encryptedhidden-payload/runtime
Typosquatting, obfuscation, runtime npm install
scripts/dynamic-installautoinstall/package
Exfiltrates credentials, env, and system info
recon-exfil/install-hookpackage/manifest
Decodes and executes hidden payload
execution/evalpayload/encrypted
Sliver implant in binary
TUESDAY
Tue Sep 1 · 5 catches · 0 waves · 3 singlesCredential theft and C2 indicators
References/Publicserviceinterface
MONDAY
Mon Aug 31 · 13 catches · 0 waves · 3 singlesBrowser credential theft and evasion
delivery/download-executebrowser/chromium
installs persistent telemetry hooks
daemon/hiddendelivery/download-execute
Remote agent, persistence, credential access
dispatch/websockethidden-payload/native-extension
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories