isotope13 labs

Crit

Ecosystem

Domain

Confirmed

remote-php-counter.html Oct 16

93c9c4213a5b91bdcef98452c2776f2ad7e84e2203beeecd8b4267169eada720 O(C)H₂(CmPo)

delivery/web-injection

71/d8/71d83c6135b01575cc4042c2f47fe6650fec633d9677ad5986525a60304997f2 Oct 16

71d83c6135b01575cc4042c2f47fe6650fec633d9677ad5986525a60304997f2 O(C)H₂(CmPo)

delivery/html

VirusShare_cec3c8fcaeac34f359f69876966d5990 Oct 10

5205e6187e957aedd079db1e89db3b0e907e6ad2bb1df1cee87f95f7d944c9f8 O(C)H₂(CmPo)

Hook.html Oct 10

351f13ee46169c3561f6bbd0452fef394cef0055de57adab4baee3b9caf79027 O(C)H₂(CmPo)

Matiex.html Oct 10

6adeb9173a2412b51c926e053461e64dea731dd678ae31be1458d3e1ee9f3c66 O(C)H₂(CmPo)

DarkCloud.html Oct 10

6ce068dc25521f81bb743148bc801867aecec2a24629d61b457668a7af47e698 O(C)H₂(CmPo)

Glupteba.html Oct 10

b5d879351eda6b08507f15a949dd59bd733ad24663dbd27a6e912c332b90bf99 O(C)H₂(CmPo)

SmokeLoader.html Oct 10

ce12c674705ef43b381ecb9fe3f8aa1a839aec2375e32259956ad14ef9906e7e O(C)H₂(CmPo)

BlackGuard.html Oct 10

ea794aa3691205db483cf978e40b09fd67035767c00136af095e92759c538ca4 O(C)H₂(CmPo)

Pysilon.html Oct 10

0439073ddb07e3f16c66276173d8658bc7a8b70d27cbdafa1bc3c9e5d2480671 O(C)H₂(CmPo)

Maldal.html Oct 10

82c0a4c33483468de578c6c8078c1c5257580eea63a5d95cdb01b7b70846977d O(C)H₂(CmPo)

GCleaner.html Oct 10

b7255e935b8c6acb8eedd2261bcfc119e8c9ef6336f554f0fef2f497b7ae86de O(C)H₂(CmPo)

Coper.html Oct 10

d768c71b47d13a951453813bc7f3fc40df2867bfa7a91ddafed4b24f89cc52b0 O(C)H₂(CmPo)

Blankgrabber.html Oct 10

ed45208cd936f494e49e0193feaa511cea360d2eb4f46fe9ca8d5c0dfd19c715 O(C)H₂(CmPo)

command.ps1 Oct 3

12785f628243858bf1d8f3f9c38b968b3c599fcff73fba245f1f54b30c33d0e4 ✓ O(C)H₂(CmPo)

97% Remote code execution dropper

DontExecute.ps1 Oct 1

907e4ca33baf5b0a8f9b0c1400843fcefbbe0f9acd34e209f660ef6bcd5522a0 ✓ O(C)H₂(CmPo)

100% Remote code execution

command.bat Sep 29

22bef856ef9d32d44d4ad4cc7fe8b464b148416ea3ec8b7b67e8f6ef6c13ab64 ✓ O(C)H₂(CmPo)

98% MSHTA remote payload fetch

command.ps1 Sep 29

14696f60d5bc49a06c47381023476f288cee726c3e8cad060f2321a0f16ed702 ✓ O(C)H₂(CmPo)

96% Remote code execution from C2

trigger.ps1 Sep 25

1140af98182d4c455bb7fe36f99d0b9ffc40c896bea1c1fa8e390d5e9b92cae9 ✓ O(C)H₂(CmPo)

97% Remote code execution dropper

Backdoor.IRC.Mox.ao Sep 24

19163feef2f663f377f4d915968af2c6f802885185c786720ecdaca64c1df750 O(C)H₂(CmPo)

sample.ps1 Sep 14

80fea95c4fc1c15e87db87bc141076b7c8b33322f7d61b9c9b8908a99d3480ab ✓ O(C)H₂(CmPo)

execution/fileless

malaysia.ps1 Sep 11

d618e8d517411c3e8e7b4c155587a6e5e223c4c3135df9203dbbbe4f0a0de20b ✓ O(C)H₂(CmPo)

98% Obfuscated C2 dropper

google-cloud-logging 2.3.1 google-cloud-logging is the official library for Stackdriver Logging. 12,810,338 installs Sep 10 gem

a9c00cdae643a86173ba8c02a2a9d9c3c7ee2d8ad3029f4876a7d13913d230b1 O(C)H₂(CmPo)

google-cloud-logging 2.4.0 google-cloud-logging is the official library for Stackdriver Logging. 12,810,338 installs Sep 10 gem

2b9b5cebf06adc7b9fa317320fbdf85b575d8eb9ad6bb9ca496f59749a2bf8bd O(C)H₂(CmPo)

google-cloud-logging 2.6.0 google-cloud-logging is the official library for Stackdriver Logging. 12,810,309 installs Sep 10 gem

f0df57bf43c9a3b1e0699ee827f94abc915cb1725457d08c56da19d92c551cec O(C)H₂(CmPo)

google-cloud-logging 2.3.2 google-cloud-logging is the official library for Stackdriver Logging. 12,810,309 installs Sep 10 gem

1977677087fde9556479fc54831d138542f01d33d908c708724e3d53d22b3460 O(C)H₂(CmPo)

github.com/graph-gophers/dataloader v4.1.1-0.20190426234507-1c92a203988e+incompatible Sep 10 go

ace39de546c640efd605df99d5bbde508b6a05aeb4bdcb0d019dd8086a2b8e57 O(C)H₂(CmPo)

github.com/graph-gophers/dataloader v5.0.1-0.20190927171021-7991159caa0c+incompatible Sep 10 go

808059c3d478941a2159c374ec9fe55ee2bf0510dbed1b56f0dc8618ec69f4e6 O(C)H₂(CmPo)

code.ps1 Sep 7

34dfe9e3c9ca87274eb871cf48d3432d2f09cadd5ff39dbc1aff3ad1e3ce926d ✓ O(C)H₂(CmPo)

94% Remote code execution dropper

uze 0.0.0-alpha.0 Install once. Native everywhere. A compatibility layer for agent tooling across Claude Code, Codex, OpenCode and Antigravity CLI. Sep 5 rust

10cfa3d1a0123d621845c1f04594898b3a0afdfc8625c9a6ca9e01c34e1d3c34 O(C)H₂(CmPo)

mjml-rails 4.2.5 Render MJML + ERb template views in Rails 10,070,978 installs Sep 2 gem

5090bf3cb6d850596df2402382d36787a66941dccbf81fa7f2ff9d14b96582af O(C)H₂(CmPo)

2% Legitimate MJML Rails gem

mjml-rails 4.3.1 Render MJML + ERb template views in Rails 10,071,060 installs Sep 2 gem

c3b2c90a2267fb36cdd1cdd6587fdb68529304d4e9febb58b4e7dae44262376e O(C)H₂(CmPo)

2% Legitimate MJML Rails gem

mjml-rails 4.2.4 Render MJML + ERb template views in Rails 10,070,978 installs Sep 2 gem

a755fae40e30eb7e4f0b06a4abc90e0ea9dc69d0f7bcbc0490973aa5b32e80ff O(C)H₂(CmPo)

2% Legitimate MJML Rails gem

mjml-rails 4.3.0 Render MJML + ERb template views in Rails 10,070,903 installs Sep 2 gem

e7f41c8d85a2cb4d8a87f96687b3843d258595487dcba224dd42aa56956c67f8 O(C)H₂(CmPo)

2% Legitimate MJML Rails gem

mjml-rails 4.4.0 Render MJML + ERb template views in Rails 10,070,903 installs Sep 2 gem

ce1ec17990fa923fb54ec6f6182d897d2c3e718f82c051864b2aa719c93680cd O(C)H₂(CmPo)

2% Legitimate MJML Rails gem

mjml-rails 4.3.2 Render MJML + ERb template views in Rails 10,070,903 installs Sep 2 gem

bc2ed53cc0fbf627ad79f61dd2f2cd45832915df462d942464b42495d04bf306 O(C)H₂(CmPo)

2% Legitimate MJML Rails gem

README.md Sep 1 arch

f759b9c6f2d438ad69f8fab08ad89cd7f700b60677ea0d450736ce9a959cbc59 O(C)H₂(CmPo)

file01.ps1 Aug 29

c0fc88748c4c1e0b0641ec912c7f5643dd844989646f540b4d0a2a513fb23d93 ✓ O(C)H₂(CmPo)

91% Remote code execution via IEX

script.ps1 Aug 23 windows

0fbd7d092fa230ee22935b919f783aa0d51fb03b93483c85a211076daf2ce116 ✓ O(C)H₂(CmPo)

execution/fileless

github.com/Ale32bit/Quartz v0.0.0-20260814174851-719767ea756d Aug 17 go

ab143c81b4282e2c74db931bf2ce083959a0ccad2610283514aa96a3b64fdc20 O(C)H₂(CmPo)

jinaai/jina-embeddings-v2-base-code main Aug 2 huggingface

799ccbde8e1dfeda7cad79a81e5d6dfd4037f118e169185183885ec28119849c O(C)H₂(CmPo)

4% Standard NLP vocabulary file

Test-Future-IO-Impl 0.21 Jul 27 arch

b9318c526497b5cb32dc0d8616020af02f5e746d592b95ce44ce0e00ea04047d O(C)H₂(CmPo)

shell/socket

LWP-Protocol-https 6.17 Provide https support for LWP::UserAgent Jul 23 perl

361c7c1eee8cf66812958f975f26ef2e2272a0c6221d2043477cb9c22b8d1c23 O(C)H₂(CmPo)

37% Legitimate Perl library test suite

ps.ps1 Jul 23 windows

0ea17807b709db137a996ba1d021f86e89a1a8257d5bb04494caa78049d4c75d ✓ O(C)H₂(CmPo)

100% Remote code execution via PowerShell

LWP-Protocol-https 6.16 Provide https support for LWP::UserAgent Jul 23 perl

a623835be3912e4e619a200cdafc87feaf9790b75c7f1d722a22bf135d65ea51 O(C)H₂(CmPo)

shell/socket

ValidateUnion 0.3.2 Jul 21 powershell

babddf35d4d19c5ac74a3714fa861896a6c2a8c8e4cf7857933a535798c69749 O(C)H₂(CmPo)

github.com/containerd/containerd/api v1.11.1-0.20260720002448-c792ddd46d61 Jul 20 go

e4ae2f99d6f2ed88183ee83ff561e54d16787413007dd560e76bd6aa011e7c29 O(C)H₂(CmPo)

40% Legitimate containerd library code

bencheeorg/benchee 1.5.1 Easy and extensible benchmarking in Elixir providing you with lots of statistics! Jul 18 github

cf2551a7f2eded95e9c261046e6d7b94ba5d7616c43bf641d49789f5fbe9a591 O(C)H₂(CmPo)

POE-Component-IRC-Plugin-CPAN-Info 1.001003 PoCo::IRC plugin for accessing information about CPAN modules, distributions and authors. Jul 13 perl

7c2143617b080f6a033f991149e5f4d1599dc7c0ed39aad50ff293041b0fa99b O(C)H₂(CmPo)

43% Legitimate Perl CPAN module

deluge Jul 8 windows

09c3ca184200559e46d7ff6bfb8e1e331065bd98667b16c0337dc7c43df90b37 O(C)H₂(CmPo)

copilot-sdk-supercharged 2.4.0 A Ruby SDK for interacting with the GitHub Copilot CLI server via JSON-RPC 2.0. Provides session management, tool registration, permission… 4,260 installs Jul 7 ruby

280b5f83c3cdc8b35f991df37200f8a541f107a341bf18df2bf1c306128780f0 O(C)H₂(CmPo)

59% Standard Ruby SDK source code

polar-ble-sdk 1.0.0 An open-source Python SDK for connecting, monitoring, and capturing raw physiological and IMU data from Polar BLE devices. Jul 7 python

d2f24b77cef3851c31bfcf9c015f334f46b15cf3f3ed66a7c1cbcdf75ca65f44 O(C)H₂(CmPo)

Executor Jul 6 windows

a9651b6ec123ba8c71d28da59ff00298978c97e5f5ed2724c018b9a7f6784fe6 O(C)H₂(CmPo)

39% Standard chocolatey package installation script

G4.CORE.RabbitMq 4.74.0 Abstrações reutilizáveis de produtor e consumidor RabbitMQ com retry/DLQ. 40 installs Jul 6 dotnet

341c43f72ed09871ee276528fd679e6a5ea34a06137867d61c8bd5162fab3bcf O(C)H₂(CmPo)

50% Standard library metadata strings

G4.CORE.RabbitMq 4.69.0 Abstrações reutilizáveis de produtor e consumidor RabbitMQ com retry/DLQ. 40 installs Jul 6 dotnet

ec44a85e9fb2af7488601718c2bd4a7964a9ab726ad736ae8510318aed2937f8 O(C)H₂(CmPo)

50% Standard library metadata strings

proficad.portable Jul 6 windows

11044df2bbecdf2f568978d6fbd651e7d0a42ed2f435be1566fcc9603ad34cfb O(C)H₂(CmPo)

XFramework.IdentityServer.Integration 1.0.1-dev.198 XFramework IdentityServer service wrapper for cross-module Bolt RPC calls. 7,085 installs Jul 5 dotnet

1d3a5e000134fa4853513173f020c17c603f3496bc89b1681f1bc02cd4e9ace7 O(C)H₂(CmPo)

55% Legitimate .NET library package

alligator 26.04.3-1.fc45 Jul 5 fedora

4dd9215b61a462cdd3ead2ed3c238ac59ab8b8eb070b9e208cc427d4ce4a2c19 O(C)H₂(CmPo)

50% Legitimate Fedora source package

Mail-Sendmail 0.83 Jul 4 perl

bbe96fc50f6e1cc6bea1e35e9c04fd4b0ec0501b6cf86bbadabd9e144b0a8bd7 O(C)H₂(CmPo)

100% Legitimate Perl module source code

PSComplexity 0.1.0 Jul 3 powershell

ee079a75404452a0a03ed77fb413b32d1ead2fcb65b018ebcebef2bc0e15c98d O(C)H₂(CmPo)

JD.AI.Channels.Signal 1.1.688 Signal channel adapter for JD.AI Gateway — bridges to signal-cli via JSON-RPC. 45,396 installs Jul 3 dotnet

3452329112f8cc79c8bb2656450e4dd4edccd9f72275961ec09d82b00b38d57c O(C)H₂(CmPo)

gr-osmosdr 0.2.5-28.fc45 Jun 30 fedora

16236995260486d6bd050579e9e134d1956ccb8d301549a33f48f41bfbcc4ef3 O(C)H₂(CmPo)

phonexia-time-analysis-client 2.1.0 Client for communication with Phonexia time analysis microservice. Jun 30 python

63098e6b4cabd48215345f8d650af2a347998b2060284cd4e9bee73332947061 O(C)H₂(CmPo)

50% Legitimate Python gRPC client package

github.com/swrz-ai/continuum-monitor v0.0.0-20260629181836-9c58df8bc8a1 Jun 29 go

ed1f4b2b323512c18aff75690b501727ee03e4260607272a4d2c66e94707ebbc O(C)H₂(CmPo)

40% Legitimate IoT monitoring software

IglooSoftware.Sdk.Notification 2.0.0 Igloo SDK for sharing notification components 18,024 installs Jun 29 dotnet

9290a162c6a31ac5abe19a018458f5cf36248ddc7c6735da6f499858dd68e4ba O(C)H₂(CmPo)

80% Staged loader detection in archive

veles-finance-mcp 1.0.0 MCP server for Veles Finance Agent — AI-powered financial analysis via x402 micropayments (USDC on Base) Jun 29 python

723c8d0c3957afad7f018edbf0ff5edbc82482f48ab1f83288400fd0cb21c985 O(C)H₂(CmPo)

80% Staged loader detected in archive

veles-finance-mcp 1.0.1 MCP server for Veles Finance Agent — AI-powered financial analysis via x402 micropayments (USDC on Base) Jun 29 python

9517925c2c6fd45f0f66b9c6993a9a917f485e810f6d832637740356ad50832a O(C)H₂(CmPo)

80% Staged loader archive detected

HorusAPI 0.9.2 Horus API package for building plugins. Version: 0.9.2 Jun 28 python

b131183932df083ef21a8e29da0bcc47ac76ef4cb49cdf7e7a962f602dae2dfe O(C)H₂(CmPo)

feat-sdk 0.2.0 Server-side Ruby SDK for feat. Polls a per-environment datafile and evaluates flags locally with no per-flag network call. Stdlib only. 460 installs Jun 27 ruby

99f2e1d415f409820dfdf4f18b5715182d2dbd2dd60c602a1691753ba339a876 O(C)H₂(CmPo)

42% Standard Ruby SDK library code

tosfsspec 2026.6.26 TOS implementation for pythonic file-system interface Jun 26 python

918322b68f6ceed7337da3a3b91f57d3cbe7e3da25ef3296c121f08beb4b9d08 O(C)H₂(CmPo)

ms2hf 0.1.0 Jun 25 python

92050e251c9dd41941491ac2e9a1bf7cb9d38f46df2a7cfe25776e163a8d5435 O(C)H₂(CmPo)

Bot-IRC-X-Message 1.09 Jun 23 perl

bd868b7596995f65c89f77f703a4654b1263de28aeb618ab1ccf9e96bbe6fcf2 O(C)H₂(CmPo)

Vimes.SignSDK.Merchants.CMC.Domain 1.0.21 Jun 23 dotnet

a410c06accfcf1b573c017a4c6b47fdae84446086b60db520d9319bb9d2d302f O(C)H₂(CmPo)

80% Staged loader comment in archive

slack-mpm 0.1.7 Jun 23 python

e1ea2bb9997c740cbdee863d96f6bbf6dfd0f860bd7f3528e3d462d709210687 O(C)H₂(CmPo)

38% Legitimate Slack MCP server package

slack-mpm 0.1.8 Jun 23 python

e04aee1d3960e7175ffb006b4075569751b785f05f95796287faaa18a311f97a O(C)H₂(CmPo)

XFramework.IdentityServer.Integration 1.0.1-dev.146 Jun 23 dotnet

b9d1e3eb52fb9825088a8f2174d3a6a59dcde574cf392c2022f1e00659bed3c7 O(C)H₂(CmPo)

index.html Jun 20

78c0a269712ec4db2818b647700050356bbee825be990544cc4a092d370d6ca7 O(C)H₂(CmPo)

99% infrastructure/operator

TheKrystalShip.KGSM.Lib 1.1.0 Jun 12 dotnet

07bc14ba947a5de247e4b5cb6754c6d003d381c76abb52d8257fc5d9c0a99c85 O(C)H₂(CmPo)

ecliseutils 0.1.0 Jun 11 python

06482d857d342769c471d2789f40896198e6ed1046ac2f479ed7febb0039a2c2 O(C)H₂(CmPo)

writers 1.7.0 Jun 11 python

70f6420460e8a23c5d626e63fe34983f0f66ececb5c37fdf97d953fda9dd646f O(C)H₂(CmPo)

CGI-ACL 0.08 Jun 6 perl

4d00630b3d4cf90cda206d47f0f476877f213cd844e90c217b3ef96bb07a6c63 O(C)H₂(CmPo)

main.rs Jun 4

bd2ede1af9638694ccd0cb589897fd9ba49c3ef36892ef0f13127acb2bccae04 O(C)H₂(CmPo)

main.rs Jun 4

b7d0176c770e40b4971d36e7e831de3e490949185f0c90fb35bf028b88960d93 O(C)H₂(CmPo)

flooduhq.py Jun 4

84d017048cfe9812c0561f474b70d5522c6d09c2440dd7706730cf42d39f33da O(C)H₂(CmPo)

test__xxinterpchannels.py Jun 4

8708def80c69342c50ebd6b7d888e39232535e0037c8ac035b33b78b5626ed4d O(C)H₂(CmPo)

alibabacloud-ack-cli 0.0.1-beta.1 Jun 4 openclaw

5abb6e2d7b17b5986e31f9269305defa7dab8ba30c6a5cb3bfaec41db592d697 O(C)H₂(CmPo)

TrackStash.Transcode 0.1.0 May 31 powershell

bf52531691fb3b9e196fa8c4d4da53b94ba0bff6d434c8189a1a558b87d4122c O(C)H₂(CmPo)

habapp_rules 11.2.0 May 30 python

e6d25edd7b2da1c86c4b7cb2d81c039041bb8b737561123a2ddcec106928c875 O(C)H₂(CmPo)

AccountDiscovery.java May 29

320e99dc7a31123c315d5472ef0e1d38e47f46b4ccf83ff2c18872f4a4a01c39 O(C)H₂(CmPo)

trophy_api_client 1.10.0 May 25 ruby

3cbd925cc3cb79aeae8731ebac1079bf26d161609286a6e114c1657bd7ec87a4 O(C)H₂(CmPo)

azure-functions-openapi 0.18.2 May 23 python

79343e2f684bc10792e3ee78a8be0dee7e7c809566256b3da75c618b676a3d92 O(C)H₂(CmPo)

WWW-RobotRules 6.03 May 22 perl

8522b532935a11bfa688c2e113bac66729df4851be50c2c26d4b06f45fade472 O(C)H₂(CmPo)

opentelemetry-instrumentation-fastapi 0.63b1-pyhd8ed1ab_0 May 22 python

7ea7782d1506eccc7f7371585159a4fe71cc8d7f1cd16966096126302e71ba24 O(C)H₂(CmPo)

flyteplugins-sglang 2.3.5 May 21 python

41d6e7ffec47dca98ca8e8be916bc7377d59c50039e5e1a762613f3863941e0b O(C)H₂(CmPo)

5ad2430bdcfd2bb75198d2d893ea356a.js May 21

d599a8b97a52ed04c87cc16e787644016842a79db92bf19e8ea25a42f2d86d7b O(C)H₂(CmPo)

WWW-RobotRules 6.02 May 21 perl

46b502e7a288d559429891eeb5d979461dd3ecc6a5c491ead85d165b6e03a51e O(C)H₂(CmPo)

python-homewizard-energy 10.1.0 May 21 python

bd505d42263089b68155feb3aa6b37ec1e8e4bb554bdaf656a5b8a8b20134979 O(C)H₂(CmPo)

opentelemetry-instrumentation-fastapi 0.63b0-pyhd8ed1ab_0 May 20 python

3ef1c3960870c2ca53cc6d8d2235d186744e8749e49fded0bd45c2637e8b0348 O(C)H₂(CmPo)

agentbus 0.1.8 May 20 python

7e7fba964d94d53009f28d4d7e5ac041d945f98c93536dffd6635fa33a8510a6 O(C)H₂(CmPo)

6c7b2aaae4101550fb73fe24d98a3fef8eb0c4ee4dc1444f19c54f6fd67b70f7.cmd May 19

6c7b2aaae4101550fb73fe24d98a3fef8eb0c4ee4dc1444f19c54f6fd67b70f7 O(C)H₂(CmPo)

Index