Fallout in javascript, since Sep 12

What we caught this week while monitoring over 162,913,247 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Sep 13 · 6 catches · 0 waves · 3 singles
micro-behaviors/communicationsmicro-behaviorsmetadatametadata/importmicro-behaviors/fsmicro-behaviors/processmicro-behaviors/datamicro-behaviors/osmetadata/langobjectivesobjectives/command-and-control+1 10d
@ishitgami/agentping 0.1.0 javascript 10 days ago

Downloads, executes remote code

execution/script-dropper
micro-behaviors/communicationsmicro-behaviorsmetadatametadata/importobjectives/supply-chainobjectives/discoverymicro-behaviors/datamicro-behaviors/osmicro-behaviors/processobjectives/exfiltrationobjectives+1 10d
sql-limit-enforcer 10.0.0 javascript ✓ 10 days ago

Exfiltrates system info via postinstall

oob/oastexfiltration/sensitive-data
objectives/supply-chainobjectiveswell-known/libwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/importmicro-behaviors/datamicro-behaviors/osmicro-behaviors/process+5 11d
w-ffmpeg 1.0.20 javascript 11 days ago

Hostile dependency w-zip

SATURDAY

Sat Sep 12 · 4 catches · 0 waves · 3 singles
well-knownwell-known/libmicro-behaviors/communicationsmicro-behaviorsmetadata/buildmetadataobjectives/credential-accessobjectives/executionobjectives/anti-staticobjectivesobjectives/supply-chain+7 11d
noblox-asset.js 7.6.0 javascript ✓ 11 days ago

Heavily obfuscated install script

obfuscator/js-obfuscatorhidden-payload/runtime
well-known/appwell-knownmicro-behaviors/processmicro-behaviorsmetadatametadata/importobjectives/executionobjectives/evasionobjectives/credential-accessobjectives/command-and-controlobjectives+18 11d
beast-agent 2.44.2 javascript ✓ 11 days ago

Keylogging and credential theft

delivery/download-executesecrets/npm-registry
micro-behaviors/communicationsmicro-behaviorsmetadatametadata/importobjectives/persistenceobjectives/supply-chainobjectives/credential-accessobjectives/discoveryobjectives/impactobjectives/command-and-controlobjectives+7 11d
local-mcp 3.0.386 javascript ✓ 11 days ago

Persistence, config injection, remote code execution.

execution/script-dropper
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories