Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| emailnpmpacketmaintainmember8@proton.me | Phase 3 publisher account (npmpacketmaintainmember8). Published 4.13.7 on 2026-06-27. | 1 | |
| urlhttps://v3.jiathis.com/code/art.js | Injected script URL in art-template@4.13.6 and 4.13.7 (atob decoded from aHR0cHM6Ly92My5qaWF0aGlzLmNvbS9jb2RlL2FydC5qcw==). Returns 404 as of 2026-07-03. | 1 | |
| urlhttps://v3.jiathis.com/code/jia.js | Injected script URL in art-template@4.13.5 (with ?uid=artemplate param). Also loaded by legacy JiaThis widget embeddings across thousands of Chinese websites. LIVE, serving gambling redirect payload. | 1 | |
| emailmarketfront@tutamail.com | npm maintainer email for the marketfront account that published the 25 Wave 4 packages. Anonymous Tutanota (tutamail.com) address. Fifth publisher identity and fourth distinct email tied to the oob-moika-tech campaign (after mr.4nd3r50n/pik-libs, nath.dr4k3@gmail.com, emcd-vue@proton.me). | 1 | |
| url/api/v1/events | Wave 4 exfiltration path. Receives a gzip-compressed HTTPS POST carrying harvested credential-file contents, gated by a custom X-Secret header. The full C2 host is RC4+XOR-concealed in the payload and was NOT statically resolved — only the path is known. Detection artifact: outbound POST to /api/v1/events with an X-Secret header and gzip body from a workstation/CI agent during npm install. | 1 | |
| domainnpm.marketfront.io | Fabricated internal npm registry lure in the @marketfront package READMEs (registry=https://npm.marketfront.io). Scope-parameterized social-engineering artifact (npm.<scope>.io), NOT confirmed functional infrastructure. Same pattern as npm.car-loans.io / npm.cloudplatform-single-spa.io / npm.t-in-one.io in prior waves. | 1 | |
| domaintelemetry.marketfront.io | Fabricated telemetry cover-story endpoint referenced in @marketfront READMEs (telemetry.<scope>.io). Social-engineering artifact to normalize expected outbound network activity at install time; NOT the actual exfil destination (which is the RC4-concealed C2 at path /api/v1/events). | 1 | |
| domaingithub.marketfront.io | Fabricated GitHub Enterprise subdomain used as the repository.url in @marketfront package metadata (git+https://github.marketfront.io/platform/<pkg>.git). Scope-parameterized social-engineering artifact (github.<scope>.io); not confirmed functional infrastructure. | 1 | |
| sha2563a24e0fd22dce86e897b09cdb146514a0dcf2430a5d3f307c6b5959155c34b33 | postinstall.js payload SHA256 in @emcd-vue/auth@7.1.0 (Wave 3 scope, republished/live as of 2026-07-02). Corroborates the same-operator link across waves. | 1 | |
| sha25678b06a93c16d990d896ed2c77f48097977ae452f009c0345b5396efdf963a97c | postinstall.js payload SHA256 in @emcd-vue/loans@7.2.0 (Wave 3 scope, republished/live as of 2026-07-02). | 1 | |
| sha256acb6f87e440ccb5efe299313e7adb506586e31a6e7381515a9fb2057965f715e | postinstall.js payload SHA256 in @emcd-vue/b2b-pay-form@5.8.0 (Wave 3 scope, republished/live as of 2026-07-02). | 1 | |
| emailt.tqm.mfe@proton.me | npm maintainer email for the t.tqm.mfe account that published @tqm-mfe/main. Anonymous Proton Mail address and a NEW actor identifier — distinct from marketfront@tutamail.com (the same-day @marketfront Wave 4 sibling). Sixth publisher identity and fifth distinct email tied to the oob-moika-tech campaign (after mr.4nd3r50n/pik-libs, nath.dr4k3@gmail.com, emcd-vue@proton.me, marketfront@tutamail.com). | 1 | |
| md57c1a3a2eea2fa01246179bcfcd2648b0 | scripts/postinstall.js md5 in @tqm-mfe/main@5.4.7. ~182 KB obfuscator.io-style single-line payload, RC4/XOR-behind-base64 obfuscation class (same family as @marketfront Wave 4). Differs from the 5.5.0 postinstall.js. | 1 | |
| md5eba5d3fa62ff3bbcd9d3a75d7f884de2 | scripts/postinstall.js md5 in @tqm-mfe/main@5.5.0 (dist-tag latest, changelog claims 'Added ARM64 support'). Differs from the 5.4.7 postinstall.js md5, indicating a re-obfuscated / updated payload between the two ~2h-apart versions. | 1 | |
| md57f01e8546af142347587931cf56cc47a | dist/index.js md5 in @tqm-mfe/main (identical across 5.4.7 and 5.5.0). Non-functional decoy: module.exports = require('../src/index.js'), where ../src/index.js is absent from the tarball — the library cannot load, so only the postinstall hook runs. Same decoy-facade pattern as @marketfront Wave 4. | 1 | |
| domaindocs.tqm-mfe.io | Fabricated docs domain in @tqm-mfe/main metadata (homepage https://docs.tqm-mfe.io/platform/main). Scope-parameterized social-engineering artifact (docs.<scope>.io); NOT confirmed functional infrastructure. | 1 | |
| domainjira.tqm-mfe.io | Fabricated Jira domain in @tqm-mfe/main metadata (bugs.url https://jira.tqm-mfe.io/projects/PLATFORM). Scope-parameterized social-engineering artifact (jira.<scope>.io); NOT confirmed functional infrastructure. | 1 | |
| domainnpm.tqm-mfe.io | Fabricated internal npm registry lure in the @tqm-mfe/main README (registry=https://npm.tqm-mfe.io). Scope-parameterized social-engineering artifact (npm.<scope>.io) to imply a private registry (the precondition for dependency confusion); NOT confirmed functional infrastructure. | 1 | |
| domaintelemetry.tqm-mfe.io | Fabricated telemetry cover-story endpoint referenced in the @tqm-mfe/main README (telemetry.<scope>.io). Social-engineering artifact to normalize expected outbound network activity at install time; NOT the actual exfil destination (which is the RC4-concealed, unresolved C2). | 1 | |
| domaingithub.tqm-mfe.io | Fabricated GitHub host used as the repository.url in @tqm-mfe/main metadata (git+https://github.tqm-mfe.io/platform/main.git). Scope-parameterized social-engineering artifact (github.<scope>.io); NOT confirmed functional infrastructure. | 1 | |
| sha256ceff7c51d70832c3ec8dd2744b606a23b3c924ef664ae23439b9b742ea154108 | Decrypted Bun bootstrapper (_b blob), identical across all 20 LeoPlatform infected packages | 1 | |
| sha2569f93d77d32833a515bc406c46da477142bb1ac2babeecb6aa42f98669a6db015 | Decrypted worm payload (_p blob), identical across all 20 LeoPlatform infected packages (781,580 bytes) | 1 | |
| sha124a0d9e496ec07ca978fab602d5f5e0b39fa03a0 | Infected tarball SHA1: leo-logger-1.0.8.tgz | 0 | |
| sha15e75c14b8acd5752819ab7a10874ddd6389f5238 | Infected tarball SHA1: serverless-convention-2.0.4.tgz | 0 | |
| sha1e973173fb757d2dab9c6424b440dd9f7cbe4f14a | Infected tarball SHA1: leo-cache-1.0.2.tgz | 0 | |
| sha1a8cb86b78ca56befe90dc466642cb04b98079909 | Infected tarball SHA1: rstreams-shard-util-1.0.1.tgz | 0 | |
| domainwshu.net | SUPPORTING signal, NOT a unique attacker indicator. wshu.net is a PUBLIC DISPOSABLE-EMAIL provider (verified on disposable-email blocklists: disposable-email-domains, fakefilter, MISP warninglists, authgear free-email list, and in unrelated apps' temp-mail signup logs), so the domain alone catches many unrelated throwaway accounts and is a noisy pivot. The campaign uses the per-scope burner pattern <scope>-<6rand>@wshu.net across all 12 scopes; treat that pattern as corroborating evidence only when combined with the durable code fingerprint (shared runPrepare/onInstall javascript-obfuscator wrapper + byte-identical/near-identical payload blobs + the 2026-06-04 publish burst), not as a standalone domain pivot. The earlier noon-contracts npm package (publisher noondeved94ed@wshu.net, 2026-05-10) shares only this disposable-email provider, not payload or code. | 1 | |
| emailapexcraft-8uiljr@wshu.net | npm publisher email for the @apexcraft scope (root @apexcraft/nano-key). | 1 | |
| emailbytemend-dwzfhq@wshu.net | npm publisher email for the @bytemend scope (@bytemend/mfebus). | 1 | |
| emailchunklab-bpriqx@wshu.net | npm publisher email for the @chunklab scope (@chunklab/hexparse). | 1 | |
| emailzynkit-sk393b@wshu.net | npm publisher email for the @zynkit scope (@zynkit/jwtbytes and the @zynkit/probe stub). | 1 | |
| emailpetitcode-eq1efk@wshu.net | npm publisher email for the @petitcode scope (@petitcode/eb-retry). | 1 | |
| emailtinyfox-yjwiqz@wshu.net | npm publisher email for the @tinyfox scope (@tinyfox/shapecheck). | 1 | |
| emailglitchpad-revqgz@wshu.net | npm publisher email for the @glitchpad scope (@glitchpad/throttler). | 1 | |
| emailthymelab-v0et8w@wshu.net | npm publisher email for the @thymelab scope (@thymelab/logfx). | 1 | |
| sha256618dfffb6829356c131fded9f4c6528b73b4f9d7ff1fc1d3b457599a12584e29 | Obfuscated payload blob dist/cjs/seed.cjs in @apexcraft/nano-key 1.3.7 (277264 bytes). | 1 | |
| sha256a9a28f2e9f7e0348092682940b3bf63d47a63afc18eb8bfe628e5ddab0d73b47 | Obfuscated payload blob dist/bootstrap.js in @bytemend/mfebus 1.4.2 (277306 bytes). | 1 | |
| sha25624c8f9b8ac17c2f88cc01d44543963206472112510962b68cf5f74d598b3b065 | Obfuscated payload blob script/prelude.cjs in @chunklab/hexparse 1.1.6 (277265 bytes). | 1 | |
| sha256d06ee17d30ebb333ab2e5b6e8a1324fcf95edaaae17b6793ec0f3647338efda1 | Obfuscated payload blob dist/prelude.cjs in @zynkit/jwtbytes 0.5.3 (282050 bytes). | 1 | |
| sha25632d02f806d58a6670f7cc9b93f1d85b22e0e0f535e1f90a62d86918033896f54 | Obfuscated payload blob lib/warmup.js in @petitcode/eb-retry 1.3.5 (282294 bytes). | 1 | |
| sha2560d27ca72b6f02faf4db95effb18347a7e2fa2def2034707bf9e56fa217879a3b | Obfuscated payload blob dist/bootstrap.cjs in @tinyfox/shapecheck 0.8.7 (282051 bytes). | 1 | |
| sha25668b4fe54a4c05cd0115535ebd4aa8d3cccb03ea5a685f440314814ba1b89e875 | Obfuscated payload blob (262934 bytes) shipped BYTE-IDENTICAL in TWO campaign packages: @glitchpad/throttler 2.2.3 (primer.cjs) and @lazyutil/dater 0.9.4 (dist/lib/tzinit.cjs). Confirmed via cmp/sha256 on extracted tarballs. Evidence that the actor reuses identical compiled blobs in at least one case rather than always re-seeding polymorphic per-string-RC4 builds. | 1 | |
| sha2564e927f22ad04f4ac9b487ae11412fc2a55210188789ac29f3a47ad77931907a5 | Obfuscated payload blob dist/bootstrap.js in @thymelab/logfx 2.15.5 (282151 bytes). | 1 | |
| file pathrequire(_0x45af03['GyrZN']) | Dynamically-obscured require with an identical variable name (_0x45af03) and proxy key (GyrZN) across most campaign payload blobs. Resolves a Node built-in module name from a decrypted RC4 string at runtime to keep it out of the static module graph. Cross-package code fingerprint. | 1 | |
| emailbriskforge-5psyxc@wshu.net | npm publisher email for the @briskforge scope (@briskforge/envcheck). | 1 | |
| emaillazyutil-78muyg@wshu.net | npm publisher email for the @lazyutil scope (@lazyutil/dater). | 1 | |
| emailfrostnode-gk8pbf@wshu.net | npm publisher email for the @frostnode scope (@frostnode/waitfor). | 1 | |
| emailnullzero-rlnozk@wshu.net | npm publisher email for the @nullzero scope (@nullzero/urlcat, flagged version unpublished before inspection). | 1 | |
| sha25626ddfae644673e0ad65b63caaaf67c0f7dc6c2b2b4127bb5271f8d03fb62091a | Obfuscated payload blob lib/preflight.js in @briskforge/envcheck 0.5.4 (277356 bytes). | 1 | |
| sha2562de602e6422a991346aaf0b74ed6bd525215f5177b9f7f267ccb4d82e919273d | Obfuscated payload blob dist/cjs/tickinit.cjs in @frostnode/waitfor 0.10.5 (259358 bytes). | 1 |