domain

npm-cache.com

discovered 2026-08-04

Active C2 domain retrieved from Ethereum smart contract state (slot at keccak256(1)). Impersonates npm cache infrastructure. Used for encrypted exfiltration via DomainSender (RSA-OAEP + AES-GCM).

Campaigns

Linked packages

Read the full analysis →