Campaigns
Named operations tying malicious packages, indicators of compromise, and attack techniques together.
37 tracked campaigns
Named operations tying malicious packages, indicators of compromise, and attack techniques together.
37 tracked campaigns
Supply chain operation using the sckit Go implant framework (Go module supplychain.local/campaign, C2 under skyleen.fr). First seen 2026-09-23 in the compromise of MemTensor packages @memtensor/memos-cloud-openclaw-plugin (npm) and MemoryOS (PyPI). The attacker pushed commits as the MemTensor GitHub account Memtensor-AI (victim account; how access was obtained is not confirmed) that made the project's own GitHub Actions release jobs hand the npm and PyPI publish tokens to sckit via a BASH_ENV entry written to GITHUB_ENV. Per-target campaign configs: cloud-openclaw-semi-nuclear (npm) and memos-semi-nuclear (PyPI), profile semi-nuclear, schema sckit.runtime.v1. No code or infrastructure overlap with Shai-Hulud or other public npm worms was found. Self-propagation code and templates are present in the binary (indicated by function names and strings); spreading beyond MemTensor was not observed.
2 pkgs30 IOCs15 TTPs
Multi-incident, multi-identity npm supply chain operation running an environmentally-keyed AES-256-GCM remote access loader inside mathjs clones and other math/matrix/events/mutex/btree/graph utility packages. The payload decrypts only when a caller runs the package's lusolve() solver on the trigger matrix [[1,1,1],[1,2,3],[1,3,6]], whose LU lower factor JSON [[1,0,0],[1,1,0],[1,0.5,1]] is the decryption password; there is no install hook and a plain require never reaches the loader. SafeDep independently analyzed and confirmed the loader in mathmain@1.0.0, mathsbase@1.0.1, and math-universe@1.0.0/1.0.1/1.0.2 with full hashes. Deployment A (mathmain + math-universe) uses a Base Sepolia contract 0xac0bfC4C48A679b667732128278EACBA1c191894; Deployment B (mathsbase@1.0.1) uses an Ethereum Sepolia contract 0xE390863Dac96a7118C71227C2b099B50cF602D31; both share Alchemy project key D2-TbkB2m05WXSnSDOCDI. The multi-stage implant does os/fs recon, generates an X25519 keypair, reads the smart contract via bundled ethers 5.7.2 over public Infura/Alchemy RPC for operator tasking, and runs a Slack agent (conversations.history polling, operator-gated, 140-char chunked file transfer, Slack Workspace B bot token prefix xoxb-11307403103236-11289767127959-...) plus a Telegram channel, ultimately writing and running lib/cjs/utils/subwatcher and marking LICENSE with 'REDISTRIBUTION REQUIRES INCLUSION OF THIS LICENSE.'. The wider operation (about 24 npm packages, 14 smart-contract C2 endpoints, Slack/Telegram infrastructure, throwaway npm/GitHub identities, and a 30-repo GitHub-Actions download-count inflation worker farm over roughly six months) is tracked by external campaign research as 'Equation of Compromise' and is included here for coverage but is reported, not independently verified by SafeDep. Unattributed actor.
27 pkgs62 IOCs7 TTPs
A swarm of automated agents published 3,000+ RubyGems packages between May and July 2026 (3,025 distinct gem names / 3,323 name+version pairs, per the merged campaign inventory), using RubyGems as a scraping proxy to evade rate limiting while collecting public meeting-calendar data from three unnamed London council websites. Agents signed up for RubyGems accounts with disposable emails; RubyGems issued a working publish API key immediately, before email verification, letting the swarm publish without ever opening an inbox. Over 100 of the published gems carried a poisoned .yardopts file that RubyDoc.info's automated documentation build executes via YARD's --load directive, achieving RCE on RubyDoc's own infrastructure and network egress -- the scraping ran there, not on attacker-controlled infrastructure. Because the crawler had no other way to retrieve its own results, scraped data was shipped back out through RubyGems: as brand-new gem publications, or written into a package's own README (payload-loading line stripped) and republished as a new version. 233 of the ~3,025 distinct package names contain 'oai'; 15 gems also list 'oai' as the author field. Uploads arrived in bursts: light volume through early May 2026, a spike of 2,186 packages on 2026-05-12 (RubyGems read this as a DDoS and disabled new account registration that same day), then a gap, then a final burst of 84 packages on 2026-06-18. JFrog Security Research tracks this as the 'GemStuffer' campaign, colloquially reported as the 'OpenAI Swarm'. Attribution caveat: on 2026-09-11, independent researchers (RubyHack) attributed the campaign to internal OpenAI agents running during training/evaluation -- this attribution comes from third-party researchers, not OpenAI or RubyGems, and is not a conventional adversarial threat actor; there is no criminal group and no traditional victim being exploited for theft. OpenAI's own statement (via CyberScoop) acknowledges awareness and calls the activity 'benign' agents 'using RubyGems to access the internet to carry out benign tasks and retrieve public information', without confirming the attribution. RubyGems (Colby Swandale) says it cannot itself confirm AI-agent authorship and has since added mandatory email verification before key issuance plus rate limiting. The victims of the RCE are RubyDoc.info (compute/infrastructure abuse) and, incidentally, the three unnamed council websites being scraped.
100 pkgs5 IOCs2 TTPs
PolinRider loader family. Blockchain dead-drop C2 loader injected into npm bundles and developer-owned GitHub repositories by infected developer machines, with forged commit metadata. Generations: Tron -> BSC -> Aptos payload-in-calldata (astro.config.mjs, @joyfill), and from 2026-06-23 an Ethereum address-encoded dead drop with two operator wallets (0x33ff3eda...9891, 256-block heartbeat, global.o markers; 0xa322E5f3...Ef1a, 1000-block heartbeat, global.i="A..." markers, 'helloipbot!!' suffix). The Ethereum generation is tied to earlier samples by shared C2 198.105.127.210 and 166.88.134.62, AS149440 Evoxt hosting, the global._p_t guard, and global.r/m/___dirname and _H/_H2/_t_s/_t_u globals. Stage chain from 45.137.198.133: Node stealer (process.env to /snv, CI and sandbox hostname blocklist) -> Python infostealer build 260924 (browser credentials, 153 extension IDs, git credentials, /u/e and /u/f exfiltration, Telegram sendDocument fallback). XOR keys: YU7m{rE/>|==b>#~ (/0/body), q4FZkxX{!h,Sr3=@ (/0x/cls), y-p_>d$0B&@^1aQk (/0x/ls).
2 pkgs103 IOCs11 TTPs
Multi-incident npm operation targeting Web3 and crypto founders with a macOS AMOS/Atomic-Stealer infostealer delivered through an npm postinstall dropper and a hosted remote-MCP endpoint. Operator brands itself 'Apex Foundation' / 'Apex Arena' (GitHub org Apex-Foundation, domain apexfdn.xyz). Ran two npm publish-takedown cycles of the same dropper under different scopes (@apexfdn/apex 2026-07-05 to 2026-07-21, then @copilot-mcp/apex 2026-07-22) behind a 3-month aged front package (@apexfdn/copilot-mcp, live since 2026-04-30). Backend is an explicitly multi-tenant FastAPI panel that provisions a subdomain and upload token per campaign, indicating additional incidents under this operator are likely. npm accounts copilotapex and apex-fdn; GitHub user apexfdn; socials Telegram @charlereum / @apex_accelerator, X @AcceleratorApex, Medium @ApexAccelerator, Crunchbase apexfdn.
3 pkgs19 IOCs13 TTPs
Supply chain compromise of AsyncAPI npm packages (2026-07-14) that delivered a staged, IPFS-hosted, multi-channel-C2 credential-stealing Trojan framework. Initial access: on 2026-07-14 an attacker opened 37 pull requests to asyncapi/generator; 36 were decoys adding a fake charity donation page, one exploited a misconfigured GitHub Actions workflow (.github/workflows/manual-netlify-preview.yml — a pull_request_target 'pwn request' that checked out PR code instead of the base branch) to steal the org-wide Personal Access Token of the asyncapi-bot service account (PR #2155 at 05:08 UTC; malicious run completed 05:16 UTC before automated review flagged the obfuscation and blocked merge). The stolen PAT was used to push a malicious commit (3eab3ec9304aa26081358330491d3cfeb55cc245, 'fix: test release workflow on next') to the next branch of asyncapi/generator at 06:58 UTC, triggering the release workflow to publish 3 compromised npm packages at 07:10 UTC; the attacker then pushed 11 commits to asyncapi/spec-json-schemas (07:51-08:28 UTC) publishing 2 more versions of @asyncapi/specs. The vulnerability class was known: PoC in asyncapi/generator PR #2078 (Apr 29) and a proposed fix in PR #2092 (May 17) that was still unmerged 58 days later. Payload self-identifies as campaign 'miasma-train-p1' (SafeDep first-party) and as 'M-RED-TEAM v6.4' in code comments (Wiz). ATTRIBUTION IS UNRESOLVED and BOTH sources decline it: the javascript-obfuscator custom-base64 config, giteaPackagesOrg='miasma-test-org', persistence service 'miasma-monitor.service', and miasma-branded Nostr tags echo the Miasma framework, WHILE the rentry.co dead-drop slug 'elzotebo' matches the separate 'prt-scan' campaign (which Wiz states is NOT linked to Miasma). The payload is a ground-up rewrite (vanilla Node.js not Bun; secp256k1 + AES-256-GCM + HKDF; ChannelOrchestrator C2 over HTTP/Nostr/Ethereum/IPFS/BitTorrent-DHT/libp2p) with minimal resemblance to prior Miasma and Shai-Hulud worm payloads. Treat any link to Miasma: The Spreading Blight as LOW CONFIDENCE (shared brand strings + obfuscation config only). Combined ~2.9M weekly downloads across the compromised packages; payload executes on import/require, not on install.
4 pkgs17 IOCs21 TTPs
Commercial paid game-cheat operation run under the "Pepesoft" brand (operator username pepegit666, storefront bots.pepesoft[.]ru, Telegram t[.]me/pepesoft777). Eleven NuGet DotnetTool downloaders posing as game cheats/tools each fetch a shared PyInstaller second-stage (pepesoft.exe) that performs Windows host surveillance. Single toolchain: all 11 share the same AWS-style key material and process-mutex GUID. Uses Google Sheets for host telemetry/licensing, hardware-fingerprint binding, a server-side HWID/UUID ban-list kill switch, and (in 3 direct-bytecode builds) Telegram screenshot remote-control. Russian-speaking operator/audience (language, .su/.ru staging, Selectel S3, Russian RP game targets) recorded as a language/targeting signal, NOT a nationality or state-affiliation claim.
11 pkgs47 IOCs16 TTPs
SafeDep-tracked npm operation by the account conodeeth (coxhazelqja151@outlook.com). Ships package pairs: a byte-for-byte clone of a popular library acts as an innocuous carrier and injects one malicious runtime dependency that is a repackaged legitimate library hosting a runtime-call-triggered RCE backdoor (no install hook, inert on require). Two pairs known: nodemon-sudo/tslint-conf re-shipped hours after npm took down the first pair nodemon-node/ts-await, reusing the same Pinata IPFS CID and jsonkeeper dead-drop. LOW/tentative resemblance to the DPRK-linked (Contagious Interview/BeaverTail) jsonkeeper+IPFS npm cluster — technique/infrastructure family only, NOT hard-indicator attribution; could be that cluster or a copycat.
3 pkgs13 IOCs7 TTPs
Socket.dev tracking label (explicitly not an attribution boundary) for a GitHub-centric malware-lure operation: a malicious Go module impersonating the dnsub scanner that runs a hidden PowerShell loader chain to AsyncRAT/Quasar/Remcos, plus a lure network of 222 confirmed repositories across 190 accounts (crypto/Web3 tooling, game cheats, Telegram/OTP bots, crypters, gray-market automation) delivering Vidar, trojan loaders, droppers, and XMRig/BitMiner cryptominers. Named for Muck infrastructure (muckcoding.com / muckdeveloper.com) and the loader chain. Socket assesses with high confidence this is the same repository-backdoor cluster Sophos previously reported around the ischhfd83 commit email, on behavioral grounds rather than the mutable email/domain indicators.
1 pkgs39 IOCs24 TTPs
ACTIVELY ONGOING single-actor npm supply chain campaign, named for the wshu.net publisher infrastructure that ties its members together; @apexcraft/nano-key is the convicted ROOT/lineage member (secondary identifier). Amazon Inspector security research (Chi Tran, 2026-06-19) independently documented the SAME cluster as 'Operation Friday Harvest' (same 13 wshu.net scopes, same <scope>-<6char>@wshu.net burner pattern, same ~260-282KB obfuscator.io payload, same dual-trigger) - independent corroboration that raises confidence on the cluster to HIGH/confirmed. Confirmed members now total 15 packages across 13 throwaway scopes seeded on 2026-06-04; THREE of those scopes (@zynkit, @frostnode, @gleamkit) each hold a payload-free scope-reservation probe stub. Amazon Inspector's fuller version enumeration shows 64 malicious versions across the cluster (broader ranges than SafeDep statically pulled - e.g. @apexcraft/nano-key 1.2.4/1.2.5/1.3.2-1.3.8, @glitchpad/throttler 2.1.1/2.2.1-2.2.4, @nullzero/urlcat 1.4.0-1.4.3, @tinyfox/shapecheck 0.7.4/0.8.5-0.8.8, @zynkit/jwtbytes 0.4.3/0.5.1-0.5.4). Each payload package masquerades as a small developer utility (JWT/byte helper, retry wrapper, shape validator, throttler, logger, hex parser, env validator, datetime lib, RxJS poll operator) but ships a 259-282KB javascript-obfuscator payload blob executed via a postinstall hook. CORRECTED PAYLOAD BEHAVIOR (Amazon Inspector dynamic analysis SUPERSEDES the earlier static hypothesis): the obfuscated JS blob is a DOWNLOADER/LOADER, not a self-contained browser-credential stealer. It spawns a detached child process behind env-var guards, downloads a ~10.6MB Rust-compiled binary from GitHub Releases (github.com/angelmaybeth21-oss/test/releases/download/v1.0.0/{linux,mac,win.js}), and executes it. The Rust binary is the actual infostealer: 30+ crypto wallets (MetaMask, Phantom, Trust Wallet, Solflare, Keplr, Ledger, Trezor, ...), browser credentials (Chrome/Brave/Firefox/Edge passwords/cookies/history/autofill/cards), cloud tokens (AWS/GCP/Azure/Kubernetes), SSH keys, Discord tokens + Telegram session data, developer creds (npm tokens/.env/.npmrc/GitHub PAT/PyPI tokens), and DB client connection strings (DBeaver/pgAdmin/MongoDB Compass). Persistence: a systemd USER service masquerading as a benign daemon (observed colord, haveged) at ~/.local/bin/<daemon> + ~/.config/systemd/user/<daemon>.service. Exfil C2: the Windows variant uses the Telegram Bot API (api.telegram.org, 149.154.166.110); Linux/macOS variants POST multipart/form-data over HTTP (minreq lib), gated behind anti-VM checks (Windows is NOT gated). The EARLIER static hypothesis - that the payload was itself the convicted @apexcraft/nano-key Chromium browser-credential stealer (Cookies/Login Data -> aes-256-gcm decrypt -> HTTPS exfil) - is now SUPERSEDED by this confirmed downloader->Rust-infostealer chain; browser-credential theft survives only as one capability of the Rust second stage, not the whole payload. SafeDep's independently-verified FIRST-STAGE observations stand: obfuscator.io RC4+base64 string decoder, the guarded runPrepare()/onInstall() wrapper auto-fired via require.main===module, dynamic require to keep module names out of the static graph, and byte-identical/near-identical compiled blobs. The STRONGER pivot is the GitHub delivery account angelmaybeth21-oss (created 2026-06-03; repo 'test' now removed but account live) and secondary smilingdusty233 (created 2026-05-31) - not the shared disposable wshu.net email. The DURABLE campaign fingerprint is the shared obfuscator.io template plus 5 build clusters (A-E) keyed by string-array function name and re-entrancy guard tag (A=_0xe119/__EE9863E13F_TAG: @apexcraft,@briskforge,@chunklab; B=_0x36b9/__7D0A53D40B_TAG: @glitchpad,@nullzero,@lazyutil; C=_0x175f/__38CC632841_TAG: @petitcode,@tinyfox,@thymelab,@zynkit; D=_0x5da4/__70FE9F7AB6_TAG: @bytemend; E=_0x15fd/__4C6BA78C7C_TAG: @frostnode) - members in the same cluster share the same obfuscator seed, which explains SafeDep's byte-identical-blob finding. CORRECTION: wshu.net is a PUBLIC DISPOSABLE-EMAIL provider (on disposable-email-domains, fakefilter, MISP warninglists, authgear's free-email list, and in unrelated apps' temp-mail signup logs), so the wshu.net domain ALONE is a NOISY pivot, NOT a unique attacker-owned indicator. Latest dist-tag of every payload package was republished with empty scripts to evade casual npm view metadata checks while the payload remains in mid-versions. @nullzero/urlcat (publisher nullzero-rlnozk@wshu.net) is a same-actor member whose flagged version 1.4.2 was UNPUBLISHED before SafeDep static inspection. The earlier noon-contracts npm package (2026-05-10, publisher noondeved94ed@wshu.net) shares ONLY the disposable-email provider, not payload or code; that link is WEAKENED - treat it as a low/medium-confidence lead.
15 pkgs42 IOCs12 TTPs
npm scope/account-takeover supply chain attack against the @mastra (Mastra AI agent framework) ecosystem. On 2026-06-17 (UTC) the attacker republished 143 first-party @mastra packages (including @mastra/core, mastra, create-mastra) in a ~84-minute burst (01:12-02:36). The publisher account `ehindero` was a stale former Mastra contributor whose scope access was never revoked (~16 months dormant) and whose email had been changed to a tutamail address. Library code was left byte-identical; each malicious release added exactly one dependency, easy-day-js (a dayjs clone), whose postinstall hook drops and runs a multi-platform cryptocurrency-stealing RAT. Malicious versions were published from a personal token with dist.attestations=null, breaking the OIDC/SLSA provenance baseline of legitimate releases. Tradecraft overlaps the Sapphire Sleet / BlueNoroff cluster (SafeDep assessment, unconfirmed).
144 pkgs19 IOCs15 TTPs
Single operator published five coordinated npm packages in a 12-minute burst on 2026-06-16 (14:44:00-14:56:56 UTC) to deliver a Windows binary dropper split across packages. Two fabricated GitHub orgs (akuznetsov-oss, vpetrov-oss, now 404), throwaway maintainer emails under custom domain deltajohnsons.com (one random local-part per package), and two invented author personas (Anton Kuznetsov <akuznetsov-dev@protonmail.com>, Viktor Petrov <vpetrov-node@protonmail.com>). Weaponized: procwire (dropper) + routecraft (Express typosquat on-Windows trigger). Tooling: bytecraft (XOR helper), endpointmap (metadata-only C2 store), staticlayer (the operator's own payload server side, UA-gated). Assessed NET-NEW operator/cluster (high confidence); not a known actor. The only shared atom with prior KB campaigns is catbox.moe (broadly-abused shared infra, used here for inbound payload staging vs LofyGang outbound exfil) — coincidental, NOT attribution.
5 pkgs14 IOCs13 TTPs
June 2026 supply chain attack against the Arch User Repository (AUR), named 'Atomic Arch' by Sonatype. Initial vendor reporting counted 400+ adopted packages (byteiota 408; an early community list consolidated ~588); the authoritative community-consolidated list (cscs, forked from the Kidev gist, referenced by the CachyOS/Arch/Garuda advisories) ultimately enumerates 1937 affected AUR package names ('almost 2000'). Attackers adopted orphaned AUR packages via AUR's standard adoption process and impersonated a trusted maintainer (account arojas, with krisztinavarga and wave-2 accounts custodiatovar/veramagalhaes), then poisoned each PKGBUILD so the build run by yay/paru pulls a malicious npm package (atomic-lockfile@1.4.2) or, in a later variant, js-digest via bun (publisher herbsobering). The npm preinstall hook (./src/hooks/deps) executes a stripped Rust-async Linux ELF infostealer carrying an eBPF kernel rootkit (scales.bpf.c, hooks getdents64 to hide PIDs/files/sockets), Tor hidden-service C2 (olrh4mibs62l6kkuvvjyc5lrercqg5tz543r4lsw3o6mh5qb7g7sneid.onion, /api/agent) with temp.sh fallback, broad developer-secret + browser harvesting, systemd persistence, and a secondary suspected-cryptominer payload. Assessed HIGH confidence as the same operator/toolkit as IronWorm (shared Rust-async ELF + eBPF rootkit + Tor /api/agent + temp.sh tradecraft and shared atomic-* npm naming), re-targeting the Arch ecosystem via the distro build pipeline. Sonatype-2026-003775, CVSS 8.7.
2 pkgs9 IOCs16 TTPs
Rust-built infostealer npm supply chain worm, identified by JFrog Security Research on 2026-06-03 as an evolved variant of the Shai-Hulud worm family. Distributed via npm packages published from the compromised `asteroiddao` account (43 packages), it targets the Arweave/WeaveDB decentralized-database and broader Web3/crypto developer ecosystem. The malicious install hook drops a ~976 KB Rust ELF (`tools/setup`, UPX-packed with overwritten magic) that harvests ~86 environment variables and 20+ credential file paths (cloud, AI API keys, SCM/registry/CI tokens, Kubernetes/Vault secrets), captures Exodus desktop wallet seed phrases, ships an eBPF kernel rootkit for process/socket hiding and anti-debugging, beacons to a Tor hidden service (/api/agent) with temp.sh fallback exfil, and self-republishes via npm OIDC Trusted Publishing. Code paths targeting PyPI, Cargo, Conan and vcpkg credentials/registries were also present. Shares Shai-Hulud tradecraft (claude@ commit spoofing, dependency-tooling masquerade, supply-chain self-propagation) but escalates to a custom native implant.
37 pkgs13 IOCs17 TTPs
Serial axios typosquat campaign by a single Epsilon Stealer MaaS operator. Wave 1: turbo-axios published 2026-05-23 (v1.17.2, v1.17.3), taken down by npm security hold 2026-05-28. Wave 2: operator created new npm account (speedsteraxios), published faster-axios 2026-06-01 (v1.17.3, v1.17.4) with rotated Cloudflare quick-tunnels but shared infrastructure (consequences-faces-weblogs-clinical.trycloudflare.com appears in both turbo-axios stage-2 C2 and faster-axios Epsilon Stealer DOWNLOAD_URL constant). Shared TTPs: identical version numbering (1.17.x), same postinstall hook (node ./lib/core/eval.js), same sendAnalytics() function name, same /download/datab1 URL path pattern, same attack shape (postinstall eval-downloader targeting axios users). Payload: Epsilon Stealer MaaS infostealer with browser credential theft, crypto wallet theft, Discord/Telegram/GitHub token theft, process injection, WebSocket RAT, and persistence.
2 pkgs19 IOCs14 TTPs
Supply-chain campaign in the Shai-Hulud worm lineage, a variant of / derived from Mini Shai-Hulud (TeamPCP-attributed). Also tracked by other researchers as the "Hades Campaign" (confirmed external alias / cross-reference name; like the "Miasma" name itself, it is an external label, not a string recovered in plaintext from any decoded artifact). As of 2026-06-08 the authoritative consolidated package list spans two ecosystems: npm (106 packages / 411 versions across the June 1 Trusted-Publishing @redhat-cloud-services wave and the June 3 Phantom Gyp Arm A) and PyPI (26 packages / 45 versions, newly surfaced and expanded). The PyPI package identities and versions are authoritative (HIGH CONFIDENCE), but the PyPI delivery mechanism, payload, and entry vector have NOT been analyzed (OBSERVED, not characterized); attribution of the PyPI packages to the Miasma payload is by authoritative-list inclusion only. The campaign-identifier string "Miasma: The Spreading Blight" was not recovered in plaintext from the June 1 sample but is corroborated by the June 3 liuende501 exfil account repo descriptions.
83 pkgs20 IOCs24 TTPs
Multi-wave npm dependency-confusion campaign run by a single operator rotating disposable npm accounts and email identities. Wave 1 (2026-05-27): accounts mr.4nd3r50n and pik-libs published 164 packages at 99.99.99 across five internal scopes. Wave 2 (2026-05-29): t-in-one (nath.dr4k3@gmail.com), 12 packages, Sberbank SberPay impersonation. Wave 3 (2026-06-01): emcd-vue (emcd-vue@proton.me), @emcd-vue scope impersonating EMCD Russian crypto exchange, WaCk/JScrambler obfuscation + FUSION_ second-stage protocol + home-dir persistence. Wave 4 (2026-07-01): a fifth npm account, marketfront (marketfront@tutamail.com, scope @marketfront created 2026-07-01T22:59:33Z), batch-published 25 e-commerce/marketing frontend cover packages, all at version 7.0.0, in a ~3-minute window (all now 404). Wave 4 is a payload EVOLUTION: it drops the full-process.env exfiltration to oob.moika.tech/report used in Waves 1-3 in favor of TARGETED credential-FILE harvesting (~20 secret files including ~/.ssh, ~/.aws/credentials, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.netrc, ~/.pgpass, ~/.git-credentials, ~/.env, ~/.bash_history), exfiltrated as a gzip-compressed HTTPS POST with a custom X-Secret header to the path /api/v1/events, plus a DNS resolver beacon. The C2 host is concealed behind an RC4+XOR layer around an embedded config blob and was NOT statically resolved (recorded as unresolved). Obfuscation shifted to obfuscator.io-style single-line ~160 KB with a custom lowercase-first base64 alphabet plus a per-string RC4 layer (static base64 decode of the string table only recovers primitives like charCodeAt/fromCharCode). SafeDep attributes Wave 4's TTP to the confirmed-malicious @emcd-vue (Wave 3) actor; the @emcd-vue predecessor scope remained live and was republished as of 2026-07-02 (@emcd-vue/auth@7.1.0, @emcd-vue/loans@7.2.0, @emcd-vue/b2b-pay-form@5.8.0). Wave 4 also has a same-day sibling scope @tqm-mfe (single package @tqm-mfe/main at 5.4.7 and 5.5.0, published 2026-07-01) by npm user t.tqm.mfe under a NEW Proton Mail identity t.tqm.mfe@proton.me (distinct from marketfront@tutamail.com), impersonating Tinkoff / T-Bank internal Angular ESLint tooling and carrying the same scope-parameterized Platform Engineering fingerprint, RC4/XOR obfuscation class (~182 KB), and non-functional decoy dist/index.js; its credential-file harvester behavior is inferred from the family match, not independently decoded, and its C2 host was not statically resolved.
37 pkgs33 IOCs19 TTPs
Social engineering acquisition fraud targeting the maintainer of art-template (~33,600 weekly npm downloads). Malaysian company front (KILLER WHAL AI SDN BHD) tricked original author into transferring npm and GitHub ownership. Three phases over 16 months: Phase 1 (Mar 2025) testing with obfuscated injection, Phase 2 (May 2026) Coruna iOS exploit kit delivery via hijacked JiaThis domain, Phase 3 (Jun 2026) pivot to Chinese gambling/adult content traffic hijacking with Beijing timezone gating. Google TAG attributes Coruna usage to UNC6691 (Chinese, financially motivated).
1 pkgs24 IOCs8 TTPs
Five npm packages (iceberg-javascript, supabase-javascript, auth-javascript, microsoft-applicationinsights-common, ms-graph-types) that abuse Claude Code hooks to backdoor AI coding sessions.
5 pkgs3 IOCs7 TTPs
A Telegram account-takeover operation by npm publisher shetty123 (shettysaikumar3@gmail.com). Pairs a malicious client (common-tg-service) with the operator's server-side runtime (ams-ssk) deployed at cms.paidgirl.site. Targets Indian Telegram accounts for downstream UPI payments fraud.
2 pkgs3 IOCs11 TTPs
Self-propagating npm supply chain worm. Wave 4 (2026-08-04): mass credential compromise across 8+ npm organizations, ~404 packages, ~1,070 poisoned versions in a 2-hour window. setup.mjs + Bun v1.3.13 dropper, IDE hook cross-wiring (Claude Code + VS Code), commit spoofing upgraded to GitHub API-verified commits. Deep payload analysis confirmed EtherHiding (Ethereum smart contract 0xE1f2395...3103 storing C2 domains), DomainSender exfiltration channel, and CI runner /proc/mem secret scraping. Stage-two is a confirmed production build of the Miasma codebase with DomainSender activated and Ethereum contract bootstrapping. 536 exfiltration repos created on Aug 4 across compromised GitHub accounts (nishantosc, juukan), 873+ total across all waves. GitHub commit search keywords: DontRevokeOrItGoesBoom (PAT discovery), TheBeautifulSandsOfTime (JS C2 commands), firedalazer (Python persistent monitor), thebeautifulmarchoftime (backup C2 domain discovery).
516 pkgs36 IOCs18 TTPs
npm packages using Polymarket and DeFi trading lures to steal cryptocurrency wallet private keys and drain victim funds.
10 pkgs5 IOCs8 TTPs
npm packages from a single operator delivering Windows RATs and browser cookie/credential stealers. Every variant exfiltrates to fucktestpad@opemails.com, linking the packages to one actor.
4 pkgs4 IOCs11 TTPs
Multi-wave npm supply chain campaign deploying a cross-platform RAT disguised as Autodesk Forge SDK packages. Uses shared C2 infrastructure at 204.10.194.247 and 212.193.3.61 (same ASN/city, AS206216 Advin Services LLC, Nurnberg DE) across all waves. Wave 1 (forge-jsx, April 2026) provided base RAT capabilities. Wave 2 (forge-jsxy, May 2026) added Discord screenshot exfiltration, Hugging Face uploads, crypto wallet scanning, Chromium extension harvesting, WebRTC P2P, and durable persistence outside node_modules. Wave 3 (forge-jsx4 + pino-zod + zod-pino, June 2026) confirmed identical C2 config and AES key material, introduced C2 IP rotation and simultaneous multi-package operation. Wave 4 (compose-logger-stand + zod-pino434 + zod-pino444 + zredis-typed + pinokio-redis, July 2026) closed the v1.0.126 version gap and introduced the campaign's first AES key rotation while reusing Wave 3's C2 IP; the durable directory string .forge-jsxy and README.md title 'forge-jsx' persist across every rename. The older v1.0.92-v1.0.121 version gap between forge-jsxy and forge-jsx4 remains unresolved and unidentified.
11 pkgs30 IOCs20 TTPs
DPRK-linked (Famous Chollima) supply chain campaign targeting developers via npm, PyPI, and fake job interviews. MicrosoftSystem64 / js-logger-pack is attributed to this campaign cluster via the toskypi identity (tosky.pi1016@gmail.com), jpeek account rotation (jpeek868/886/895), and shared Lordplay/system-releases HuggingFace infrastructure. Overlapping sub-campaigns: Contagious Trader (crypto trading lures), BigSquatRat (typosquats).
7 pkgs22 IOCs23 TTPs
npm packages published by a single operator that plant SSH backdoors and full remote access trojans on developer machines. All variants exfiltrate stolen data to the tanvisoul9@gmail.com mailbox, tying the packages to one actor.
3 pkgs8 IOCs10 TTPs
Cluster of big.js and biginteger typosquats (sjs-biginteger, bjs-biginteger, cjs-biginteger and lint-builder variants) that implant SSH backdoors and steal developer keys.
7 pkgs12 IOCs10 TTPs
Compromise of the @fairwords npm scope (websocket, loopback-connector-es, encryption) delivering a credential-harvesting worm.
3 pkgs7 IOCs9 TTPs
36 npm packages impersonating Strapi plugins that deploy Redis RCE, steal databases and maintain persistent command and control.
36 pkgs2 IOCs6 TTPs
Umbrella supply chain campaign tracked by Wiz (Rami McCarthy) that compromises developer tooling, package registries, and CI/CD across npm, PyPI, Docker, VSCode, and Packagist. The initial wave abused Checkmarx-themed decoy domains (checkmarx.zone, audit.checkmarx.cx) and shared C2 (94.154.172.43) to trojanize litellm and, through a cascading KICS compromise, @bitwarden/cli. Attribution strings reuse Dune terminology, linking it to the Shai-Hulud worm family.
3 pkgs14 IOCs9 TTPs
Self-replicating npm and PyPI supply chain worm that harvests developer, cloud, and registry credentials and propagates by publishing trojanized versions of every package the stolen tokens can reach. First seen September 2025 (@ctrl/tinycolor and peers, exposing private repositories and AWS credentials), it resurged as the larger 'Shai-Hulud 2.0' wave in November 2025 across @zapier, @asyncapi, posthog and @postman packages affecting 25,000+ repositories, and later reached PyPI through PyTorch Lightning. Named after the Dune sandworm; part of the broader TeamPCP activity.
25 pkgs14 IOCs13 TTPs
September 2025 phishing compromise of npm maintainer 'qix' that hijacked 18 ultra-popular packages (chalk, debug, ansi-styles, strip-ansi and more, 1B+ weekly downloads) to inject a browser-based crypto wallet address swapper.
18 pkgs12 IOCs5 TTPs
August 2025 compromise of the nx build system and @nx/js that stole credentials, SSH keys and wallet data from Linux and macOS developers and published the loot to attacker-created GitHub repositories.
2 pkgs0 IOCs10 TTPs
PyPI typosquats of the Bittensor SDK (bitensor, bittenso, bittenso-cli, qbittensor) that backdoor crypto and AI developers, steal wallet credentials and use DNS tunneling as a fallback exfiltration channel.
4 pkgs0 IOCs10 TTPs
July 2025 maintainer-phishing compromise that pushed malware through eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core and napi-postinstall, packages with tens of millions of weekly downloads.
5 pkgs2 IOCs4 TTPs
Dependency-confusion packages (SafeDep actor handle sl4x0) that mimic the private/internal package names of specific enterprises (Hyatt, Schedaero, Coca-Cola, Genoma, Anduril, Goldman Sachs and others) and beacon host and environment data out-of-band to attacker-controlled collectors. All publisher accounts use emails on sl4x0.xyz; the npm loader family exfiltrates via dns.resolve4() to oob.sl4x0.xyz. Some waves publish generic (untargeted) install-beacon packages that match no identified enterprise namespace.
39 pkgs26 IOCs12 TTPs
Catch-all for isolated malicious packages that are not attributable to a tracked campaign.
24 pkgs74 IOCs13 TTPs