Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| sha2561df8c579ffcbf5527b1856bd1774601a5188b380e442c5a0fbd400bd86a4501b | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256b29973eda4d0c090608c15a976688cad0b2114fdc0dcb89ad37515287ba13aad | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2569e9655f54bfac8a937d78ac506722bae1468ead4cc9ee95b35e0f8ef17ee13d9 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha25667e4d6a4f53098e48bfa6ecceeaa754592bc249b83404bcfb8542977ae36dac4 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2561bfa32548676d32b7639d3171e2f9feefba5026dc336968c91f4ae2b152c5410 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2562bc8af4bd2f539630f7800f3491b64c7e2bffe12e955d0d4f03a4f6a4b0018bd | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256eae055c5736366811d2a4b1f78ff206486e7f7445040122efbe023ecd2d20bcc | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256d4ed2d87942fbefa5d7b7f19fb6f2e9bc293c96bf577bb97ed3ca56185abcf25 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256447484c76a06918d7f6f6c6f95ee2bced6dd2e9b282c6f5b92b2b7c0976381d5 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256f43cb68850a2506805d60ff466f54eba331e1cc2a513b329f5121e0c39104418 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2561314fc888ca5b3ea91a04e1f5b63039ffc7fc3832b8d809a28ad549c6f9d4f23 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256af66bc2b516d1ef71af9b6ee9f8f5af0a99fed562b34809cd55071b94c2d1304 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256b157a66826d27512c3618817fee924e53d14cabb2c4c7f454affde37350f55f0 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2562303a74a5fac917279f1078e03a4bfd6afbb89462f97d7344ed10e6e9e9e92b7 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2565242c5086d75a492d14e474de7c8f34b18ec0a8a9ce6d77eec8675a9572d9d23 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2561d567795a366b9edcfef7f1fa2d398b7cb41890dd3b2f3f1f9803de0cdba0c89 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256c2e4483abea830ba8b8230540ace51788d0712bed9006697ddddb9cbf133c151 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256390bca9d70efa42cb792f7f677189821a24527cd4298ab2acb954df0abb5c1c3 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256f7d9865ea3874d2b135eeee0aa0d12fc108d89e1dd706e4e40eb7605b76d35ca | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2562b7696575278e6e223cc44553c687e45afd04df7eb32efbf49b39da64b795982 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2562edb3f162f9676196e818d9b795d599ba119a961ffe98c4866351735980d213d | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256727fe9c1dfa39d6590012e0593c9837c628fc2cd22aa0f4e486b7ed1aec02697 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2568a58e3ed713c1c70f421ab56a18cfb6a120c960d227e495b511c2552f25f188b | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha25667eb3bd505ebfffbd73fc3ef0b2976c375df732f0bd0496ed6653c3e2be5a0e5 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256616b41657e9afaa9354fc1a106393373dcbf8aac8455b7d2cbbb44463434528e | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha25652a57c502e40b3f9897d0ca32bba6f844b4113f5c017627ea9eba660eb47f405 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256d1889d81cfa99d52017732da9dc52127d03893037874c8671943cede4b8d1bb2 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256a677c02e545941e43f8b21a5761b035e911b53e2c065fea219e0f3462f282fd8 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256e076e13a7e112d364f03bd1ead7abaa83249d544491621254860ab0a73adc9b9 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256c2a69a33b086364ca51b030b6b15e99be46ce8255ddf62839a4fc7f2b34023de | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2565cd62e708ae4393c99579ec1433571998299bf7e2fde9bafeb9a79f8bdf065e9 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha25661b61dd25cd8dcc43cd78418f3e3eb3fd9002d9e49961eefb12c1022ce4c3b63 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256c6af37a6739f0d919ab7049caf3a85831cab44bdbea27e0d9de7adec80334e2b | PyPI __init__.py payload (one per PyPI package). Source published 4 hashes without a per-package mapping. | 0 | |
| sha256b04daeacd1d1c9020cce2a97fa7af83dbedf4e6d17dd12c0f337f32240399785 | PyPI __init__.py payload (one per PyPI package). Source published 4 hashes without a per-package mapping. | 0 | |
| sha256dabb47d75f2efa6a5540661484efa989ccb338f24938b23152f14f3e424b0cb5 | PyPI __init__.py payload (one per PyPI package). Source published 4 hashes without a per-package mapping. | 0 | |
| sha256c2a361a7d8feb95be97c957fc7652d348f4fa9a987bde5f09883f46b65c460f1 | PyPI __init__.py payload (one per PyPI package). Source published 4 hashes without a per-package mapping. | 0 | |
| domainv3.jiathis.com | Payload server. Hijacked JiaThis social sharing service domain (Beijing, 2009). Re-registered through GoDaddy, routed via Cloudflare. Serves gambling redirect payload on jia.js path with Referer gating. art.js path returns 404 as of 2026-07-03. Shared Cloudflare nameservers (paislee/sean) with mki.mom. | 1 | |
| domaintest.airsplu.cn | Gambling redirect destination. Chinese gambling/adult content portal (2026 World Cup Navigation). Huawei CDN (45.197.102.29). Beijing timezone-gated redirect: 7PM-6AM 100%, daytime 30%. | 1 | |
| domains5gw.mki.mom | Gambling portal backend. CNAME to 500info.win (Azure). Shares Cloudflare nameservers (paislee/sean) with jiathis.com, indicating same Cloudflare account. Baidu Analytics tracker a29b02d841cccc4c4b32f9c5dbebb0b0. | 1 | |
| domains5dh.club | Gambling portal. 301 redirect to s5gw.mki.mom. Azure IPs (20.239.154.185, 20.2.192.146). Registered 2025-02-19 via GoDaddy. | 1 | |
| domain500info.win | CNAME load balancer target for s5gw.mki.mom. DNS-only, no A record. | 0 | |
| domainl1ewsu3yjkqeroy.xyz | Former C2 sync endpoint (Phase 2). Cloudflare-fronted. /api/ip-sync/sync POST every 10s with channelCode CHMK6IG08F42496C22. DEAD as of 2026-07-03. | 1 | |
| domaindaohang.2023200.com | Former gambling API backend. DEAD as of 2026-07-03. | 0 | |
| ipv4172.67.184.213 | Cloudflare IP for v3.jiathis.com (Phase 3) | 0 | |
| ipv4104.21.59.230 | Cloudflare IP for v3.jiathis.com (Phase 3) | 0 | |
| ipv445.197.102.29 | Huawei CDN IP for test.airsplu.cn gambling redirect | 0 | |
| ipv420.239.154.185 | Microsoft Azure IP for s5dh.club / s5gw.mki.mom gambling portal | 0 | |
| ipv420.2.192.146 | Microsoft Azure IP for s5dh.club / s5gw.mki.mom gambling portal | 0 | |
| sha256e27a0e28da18a7978dd0139bccf48ec5c39454fda6384c95fc0fb004b3b502a2 | art-template@4.13.7 npm tarball (Phase 3, published 2026-06-27 by npmpacketmaintainmember8) | 1 | |
| sha2567c59001d7bdd0dfb04b89d2de3d71b18975b20f22b2af880911413fb29cfdff0 | v3.jiathis.com/code/jia.js gambling redirect payload (last-modified 2026-06-30). Baidu Analytics + time-gated redirect to test.airsplu.cn. | 1 |