Hostile ^92% javascript Download

@promptster/teams-cli-win32-arm64 0.34.1

Embedded credential theft rules

“promptster-teams binary for win32-arm64”

Detects executables Discord URL observed in first stage droppersNative agent watches multiple AI coding products

SHA-256fda8ede9b671564d409508a090949de2b4139b1a4d2d6f860c5d77fbf9ef7f97

URLhttps://registry.npmjs.org/@promptster/teams-cli-win32-arm64/-/teams-cli-win32-arm64-0.34.1.tgz

MaleculeK₂(LiLu)O₁₂(C₁₂Ca₇CoEu₂La₄SAlAs₃Dy₂Er₄I₃Pr₂)H₁₀(Cm₄₂Cr₁₅Db₂₃DsF₁₂HfMgOs₁₈Po₁₂U₂)Md₅(Bi₅BkPa₆Pt)Th

Evidence

Promptster telemetry API host 0x5f62e7–0x5f6417

⋯5 more rows
0x5f63377463686572206572726f723a2025760atcher error: %v.
0x5f634768747470733a2f2f6170692e70726f6dhttps://api.prom
0x5f63577074737465722e616929206e65766572ptster.ai) never
0x5f636720757064617465206f6e20697473206f update on its o
⋯11 more rows

Discord users/@me path 0x6593c2–0x6596b2

⋯3 more rows
0x6593f275736572222c2022706173732229270auser", "pass")'.
0x65940272756c65733a0a20202d206e616d653arules:.  - name:
0x65941220446973636f726420576562686f6f6b Discord Webhook
0x6594222055524c0a2020202069643a206b696e URL.    id: kin
0x659432676669736865722e646973636f72642egfisher.discord.
0x659442310a20202020626173655f73636f72651.    base_score
0x6594523a2034300a202020207061747465726e: 40.    pattern
0x6594623a207c0a202020202020283f7869290a: |.      (?xi).
0x659472202020202020283f503c776562686f6f      (?P<webhoo
0x6594826b5f626173653e0a2020202020202020k_base>.        
⋯13 more rows
0x6595626d656469756d0a202020206578616d70medium.    examp
0x6595726c65733a0a2020202020202d20687474les:.      - htt
0x65958270733a2f2f646973636f72642e636f6dps://discord.com
0x6595922f6170692f776562686f6f6b732f3132/api/webhooks/12
0x6595a2333435363738393031323334353637383456789012345678
0x6595b22f6162636465666768696a6b6c6d6e6f/abcdefghijklmno
0x6595c2707172737475767778797a4142434445pqrstuvwxyzABCDE
0x6595d2464748494a4b4c4d4e4f505152535455FGHIJKLMNOPQRSTU
0x6595e2565758595a3132333435363738393061VWXYZ1234567890a
0x6595f262636465660a2020202063617465676fbcdef.    catego
0x659602726965733a0a2020202020202d206170ries:.      - ap
⋯11 more rows

Go function hooks Cursor agent events 0xd78d48–0xd78ed8

⋯5 more rows
0xd78d98e8320d0000000000981b2a0000000000.2........*.....
0xd78da8676f3a6275696c64696400696e746572go:buildid.inter
0xd78db86e616c2f6370752e496e697469616c69nal/cpu.Initiali
0xd78dc87a6500696e7465726e616c2f6370752eze.internal/cpu.
0xd78dd870726f636573734f7074696f6e730069processOptions.i
0xd78de86e7465726e616c2f6370752e696e6465nternal/cpu.inde
0xd78df8784279746500696e7465726e616c2f63xByte.internal/c
0xd78e0870752e646f696e697400696e7465726epu.doinit.intern
0xd78e18616c2f6370752e6f73496e6974007479al/cpu.osInit.ty
0xd78e2870653a2e65712e534d31300074797065pe:.eq.SM10.type
⋯11 more rows

Go function inventories AI-agent configuration 0xe0efe4–0xe0f114

⋯5 more rows
0xe0f0346e7465726e616c2f636170747572652enternal/capture.
0xe0f0446275696c64436f6e66696743656e7375buildConfigCensu
0xe0f05473006769746875622e636f6d2f70612ds.github.com/pa-
0xe0f064617274682f70726f6d7074737465722darth/promptster-
⋯11 more rows

Go function watches Claude agent sessions 0xe10292–0xe103f2

⋯5 more rows
0xe102e26f6f6b54616b656f7665725061746800ookTakeoverPath.
0xe102f26769746875622e636f6d2f70612d6172github.com/pa-ar
0xe1030274682f70726f6d7074737465722d7465th/promptster-te
0xe10312616d732d636c692f696e7465726e616cams-cli/internal
0xe103222f636170747572652e52756e436c6175/capture.RunClau
0xe10332646557617463686572006f732e476574deWatcher.os.Get
0xe103427069640073797363616c6c2e47657470pid.syscall.Getp
⋯11 more rows

No evidence locations were recorded for this file. Raw result