Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| file pathrequire(_0x2cb1b0['UGeLH']) | Variant of the campaign's dynamically-obscured require fingerprint, found in @frostnode/waitfor dist/cjs/tickinit.cjs. Same technique as the canonical require(_0x45af03['GyrZN']) with a different variable name and proxy key — confirms shared obfuscation template across re-seeded builds. | 1 | |
| emailgleamkit-23vnic@wshu.net | npm publisher email for the @gleamkit scope (@gleamkit/probe scope-reservation stub). Same <scope>-<6char>@wshu.net burner pattern; wshu.net is a public disposable-email provider (supporting signal only). | 1 | |
| github repoangelmaybeth21-oss/test | Second-stage delivery (Amazon Inspector / Operation Friday Harvest). The obfuscated first-stage downloader pulls a ~10.6MB Rust infostealer from this account's GitHub Releases. STRONGER pivot than the shared disposable wshu.net email. Account angelmaybeth21-oss created 2026-06-03; repo 'test' now removed but the account is still live. Dropper URL pattern: github.com/angelmaybeth21-oss/test/releases/download/v1.0.0/{linux,mac,win.js}. SafeDep independently verified the account exists via the GitHub API this session. | 1 | |
| github reposmilingdusty233 | Secondary GitHub delivery/staging account associated with the campaign (Amazon Inspector). Created 2026-05-31. SafeDep independently verified the account exists via the GitHub API this session. | 1 | |
| urlhttps://github.com/angelmaybeth21-oss/test/releases/download/v1.0.0/linux | GitHub Releases dropper URL for the Linux Rust infostealer ELF second stage (Amazon Inspector). Pattern: .../v1.0.0/{linux,mac,win.js}. | 1 | |
| urlhttps://github.com/angelmaybeth21-oss/test/releases/download/v1.0.0/mac | GitHub Releases dropper URL for the macOS Rust infostealer Mach-O second stage (Amazon Inspector). | 1 | |
| urlhttps://github.com/angelmaybeth21-oss/test/releases/download/v1.0.0/win.js | GitHub Releases dropper URL for the Windows Rust infostealer second stage (Amazon Inspector). The win.js name is a masquerade; the artifact is the Windows binary. | 1 | |
| domainapi.telegram.org | Telegram Bot API used as exfil C2 by the Windows variant of the Rust infostealer second stage (Amazon Inspector). Resolves to 149.154.166.110. Linux/macOS variants exfil over HTTP multipart/form-data instead. | 1 | |
| ipv4149.154.166.110 | Telegram infrastructure IP for api.telegram.org, the Windows-variant exfil C2 of the Rust infostealer second stage (Amazon Inspector). | 1 | |
| sha2562457b2e775a5fe7a9e022ba77074a1b9aacb41b4fc0cc1d8a3dc66546599c5de | Second-stage Rust infostealer Linux ELF (~10.6MB) downloaded from github.com/angelmaybeth21-oss/test/releases/download/v1.0.0/linux. Attributed to Amazon Inspector dynamic analysis (VirusTotal/CAPE). | 1 | |
| sha256b1c7b17f31a84e2596250121c3610ae5e0d592651940dd6c0dd74506f0f38313 | Second-stage Rust infostealer macOS Mach-O downloaded from github.com/angelmaybeth21-oss/test/releases/download/v1.0.0/mac. Attributed to Amazon Inspector dynamic analysis. | 1 | |
| sha25611fe3a47333f63fd0e0a32ea16351eb302659aba983c07e4ea3dc9b09b618509 | Second-stage Rust infostealer Windows binary (win.js) downloaded from github.com/angelmaybeth21-oss/test/releases/download/v1.0.0/win.js. Windows variant exfils via Telegram Bot API and is NOT anti-VM gated. Attributed to Amazon Inspector dynamic analysis. | 1 | |
| file path/tmp/_installer-0/ | Host staging directory created by the downloader/second stage (Amazon Inspector). | 1 | |
| file path~/.local/bin/<daemon> | Persistence binary path for the Rust infostealer, masquerading as a benign daemon (observed names: colord, haveged). Paired with the systemd user unit at ~/.config/systemd/user/<daemon>.service (Amazon Inspector). | 1 | |
| file path~/.config/systemd/user/<daemon>.service | systemd USER service unit installed for persistence, masquerading as a benign daemon (colord, haveged). Loads ~/.local/bin/<daemon> (Amazon Inspector). | 1 | |
| file path~/.local/state/<daemon>/{install.nonce,machine.id} | Host state artifacts (install nonce + machine id) written by the Rust infostealer second stage (Amazon Inspector). | 1 | |
| file path__[0-9A-F]{10}_TAG | Re-entrancy guard variable-name pattern in the obfuscator.io first-stage blobs (e.g. __EE9863E13F_TAG). Together with the string-array function name it defines the 5 build clusters (A=__EE9863E13F_TAG, B=__7D0A53D40B_TAG, C=__38CC632841_TAG, D=__70FE9F7AB6_TAG, E=__4C6BA78C7C_TAG). Members in the same cluster share an obfuscator seed, explaining the byte-identical blob reuse (Amazon Inspector + SafeDep). Hunt as a code/regex fingerprint. | 1 | |
| ipv4192.168.54.1 | C2 host for MYRA RAT. RFC 1918 private address, unusual for public npm malware. Port 4444 (C2), port 5555 (screen viewer). Suggests lab/testing environment or internal network targeting. | 0 | |
| emailkimnbv@proton.me | npm publisher email for account kimijohn01, used to publish all 6 versions of apintergrationpost. Throwaway Proton Mail account. | 0 | |
| sha2566f4da8919cef1623f7a6a08cb66fc1b3d7f3e5d13f4f3b03c378c0f4a797f52f | apintergrationpost v4.0.1 tarball hash | 0 | |
| sha256bff1cee1548dfc29da7618e11fcc2569ac849f9544056b89cbaa66d0874c1788 | apintergrationpost v4.0.2 tarball hash | 0 | |
| sha256ba8e9452c53f5b66e47cc55e4e3531c1c59113950e49cf4eb5f14df1066f6390 | apintergrationpost v4.0.3 tarball hash | 0 | |
| sha256cc1287f3eb21f176e6337db4739975c457578f4b3f54fd58c899b711f4cbc58f | apintergrationpost v4.0.4 tarball hash | 0 | |
| sha2562253a51ce77c72ca1cad59fac8827a82d835bb64738cec42a2fa0d77bfac8b7e | apintergrationpost v4.0.5 tarball hash | 0 | |
| sha256a6c687f276034f5bcf8070b750060c840a80a97e350592a015ed6e0974be87c4 | apintergrationpost v4.0.6 tarball hash | 0 | |
| file path/usr/local/lib/.libcache.so | LD_PRELOAD rootkit shared object. Hooks readdir/stat to hide MYRA files and processes. Compiled from C source during npm postinstall. | 0 | |
| file path/usr/local/lib/.cache-update.sh | MYRA RAT wrapper/launcher script. Invoked by cron (*/13 * * * *) and profile.d. Sets LD_PRELOAD and launches the Node.js RAT agent. | 0 | |
| file path/etc/profile.d/.sh.local | Login persistence. Sourced on every shell login to relaunch MYRA RAT via .cache-update.sh. | 0 | |
| file path/usr/lib/systemd/systemd-userdbd | Overwritten with Node.js binary. MYRA RAT masquerades as systemd-userdbd service for process blending. | 0 | |
| domainstitch-production.org | C2 domain for credential exfiltration. Registered via GoDaddy on 2026-06-19T11:07:09Z, 75 minutes before first package publish. Cloudflare-fronted. Backend nginx/1.18.0 (Ubuntu). Mimics stitch.withgoogle.com production API. | 0 | |
| ipv4172.67.189.185 | Cloudflare IP for stitch-production.org C2 domain | 0 | |
| ipv4104.21.65.94 | Cloudflare IP for stitch-production.org C2 domain | 0 | |
| urlhttps://stitch-production.org/api/v1 | C2 endpoint. Credential exfiltration via GET query parameters: ?src=<source>&user=<email>. Fallback beacon: ?email-not-found=true | 0 | |
| emailmaximus-mcmillan@outlook.com | npm publisher email for @withgoogle/stitch-sdk. Throwaway account. | 0 | |
| sha256ba5b2a9a7fe596734fb69bdf1a35071d1a2f435a36e8c870bd4390c562d9f614 | @withgoogle/stitch-sdk v0.1.1 tarball hash | 0 | |
| sha256638b523ddd3382b622c412e37f274db1a9a6505893fa7236183f0b67a5355e94 | @withgoogle/stitch-sdk v0.1.2 tarball hash | 0 | |
| github repomaximus-mcmillan/stitch-sdk | Fabricated repository URL in package.json. GitHub user and repo do not exist (404 / deleted). | 0 | |
| emailehindero2016@tutamail.com | Operator email on the compromised `ehindero` npm account at time of the malicious @mastra republish. | 1 | |
| emailehindero2016@gmail.com | Original email on the `ehindero` npm account during its clean @mastra/core alpha publishes (2024-11 to 2025-02); same account, later changed to tutamail. Account-takeover indicator. | 1 | |
| emailsergey2016@tutamail.com | Email of the `sergey2016` npm account that published the easy-day-js dropper. Sibling <name>2016@tutamail.com pattern shared with the operator. | 1 | |
| ipv423.254.164.92 | Stage-2 download host (dropper). HTTPS GET to https://23.254.164.92:8000/update/49890878. Hostwinds, PTR hwsrv-1327786.hostwindsdns.com. User-Agent gated: serves payload only to Node default UA. | 1 | |
| ipv423.254.164.123 | RAT stage-2 C2 (still live at analysis time). HTTPS POST to https://23.254.164.123/49890878. Hostwinds, PTR hwsrv-1327785.hostwindsdns.com. Fronts an expired wolfSSL test cert CN=www.wolfssl.com. | 1 | |
| urlhttps://23.254.164.92:8000/update/49890878 | Dropper stage-2 retrieval URL; returns the 12-byte-hex-named JS RAT loader only to Node default User-Agent. | 1 | |
| urlhttps://23.254.164.123/49890878 | RAT stage-2 C2 endpoint; base64-encoded JSON beacon/command protocol (type:prepare/tpcsr/r0), default 10-minute cycle. Campaign path /49890878 shared with the dropper. | 1 | |
| sha256221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf | Stage-2 payload: 41 KB obfuscated multi-platform cryptocurrency-stealer RAT. | 1 | |
| sha2564a8860240e4231c3a74c81949be655a28e096a7d72f38fbe84e5b37636b98417 | easy-day-js@1.11.21 npm tarball (clean precursor, no install hook). | 1 | |
| sha256ae70dd4f6bc0d1c8c2848e4e6b51934626c4818dcb5af99d080ddbd7dc337185 | easy-day-js@1.11.22 npm tarball (armed: postinstall RAT dropper setup.cjs). | 1 | |
| sha2562e2340f2ab71f321d3ef6fb9a7542fb9f30f3c65ba7ef924fcd8acc63829b5bf | @mastra/core@1.42.1 npm tarball (republished by ehindero, dist.attestations=null, easy-day-js dependency injected). | 1 | |
| file pathsetup.cjs | easy-day-js@1.11.22 postinstall dropper (obfuscator.io custom-base64 string-array). Sets NODE_TLS_REJECT_UNAUTHORIZED=0, fetches stage 2, spawns detached node child, then self-deletes (fs.rmSync(__filename)). | 1 | |
| file path.pkg_history | Marker file written to os.tmpdir() by setup.cjs (contains __dirname). | 1 |