Fallout in wordpress, Aug 17 – Aug 23

What we caught this week while monitoring over 163,411,591 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SATURDAY

Sat Aug 22 · 1 catch · 0 waves · 1 single
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/buildobjectives/anti-analysisobjectivesobjectives/impactwell-knownobjectives/supply-chainmicro-behaviors/ui+9 33d
CF7 Views – Complet…t for Contact Form 7 3.2.5 wordpress cf7-views 47,049 installs 33 days ago

Malicious region-gated audio payload

supply-chain/sweetalert2-protestwaremanipulation/browser

WEDNESDAY

Wed Aug 19 · 2 catches · 0 waves · 2 singles
well-known/libmicro-behaviors/communicationsmicro-behaviorsmicro-behaviors/datamicro-behaviors/osmicro-behaviors/processmicro-behaviors/cryptoobjectivesobjectives/impactwell-knownmicro-behaviors/ui+3 36d
Shipbubble – Shippi…ation for Woocommerce 2.11 wordpress shipbubble 4,250 installs 36 days ago

Bundled protestware payload

unwanted/sweetalert2-protestwaremanipulation/browser
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/importobjectives/anti-analysisobjectives/anti-staticobjectivesobjectives/impactwell-knownmicro-behaviors/ui+9 36d
Real3D Flipbook – 3D Flip…F Viewer, PDF Embedder 5.3 wordpress real3d-flipbook-lite 234,070 installs 36 days ago

Malicious code in SweetAlert2 library

manipulation/browsersupply-chain/sweetalert2-protestware

TUESDAY

Tue Aug 18 · 5 catches · 0 waves · 3 singles
well-known/libwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadata/packagemetadataobjectives/collectionmicro-behaviors/datamicro-behaviors/fsobjectivesobjectives/credential-access+6 36d
Rent Fetch 0.39.2 wordpress rentfetch 22,875 installs 36 days ago

XSS injection in htmlescape dependency

phishing/workflow
well-knownwell-known/libmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/libobjectives/command-and-controlwell-known/toolsobjectivesobjectives/impactmicro-behaviors/ui+8 36d
Image SEO – AI-Driv…Image SEO Optimizer 3.2.15 wordpress imageseo 95,979 installs 36 days ago

Embedded malicious SweetAlert2 payload

manipulation/browser
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/langwell-known/libwell-known/appobjectivesobjectives/impactwell-knownmicro-behaviors/ui+8 37d
GIFTiT – Free Gifts for WooCommerce 4.2.0 wordpress ithemeland-free-gifts-for-woo 87,627 installs 37 days ago

Malicious SweetAlert2 payload

supply-chain/sweetalert2-protestwaremanipulation/browser
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories