Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| file path.pkg_logs | Marker file written to os.tmpdir() by setup.cjs (bytes of "easy-day-js" XOR 0x80). | 1 | |
| file path~/Library/LaunchAgents/com.nvm.protocal.plist | macOS RAT persistence LaunchAgent (typosquats nvm tooling). | 1 | |
| file path~/Library/NodePackages/protocal.cjs | macOS RAT payload body disguised as Node tooling. | 1 | |
| file path~/.config/systemd/user/nvmconf.service | Linux RAT persistence systemd user unit (typosquats nvm tooling). | 1 | |
| file path~/.config/NodePackages/config.json | Linux RAT config persistence (UID/PrimaryUrl/Cycle). | 1 | |
| file pathC:\ProgramData\NodePackages | Windows RAT persistence/config directory. | 1 | |
| urlhttps://files.catbox.moe/j4loim.chk | Decoded C2 / payload URL, reconstructed from endpointmap's _ep+_p byte arrays XOR-decoded with the name-derived key 'endpoint'. catbox.moe is a public anonymous file host abused for inbound payload staging. | 1 | |
| domainfiles.catbox.moe | Payload staging host. catbox.moe flagged by 6/92 VirusTotal vendors at analysis time. Shared atom with LofyGang (lofygang-undicy-http) but used here for INBOUND payload staging vs LofyGang's OUTBOUND exfil — coincidental shared infra, NOT attribution. | 1 | |
| domaindeltajohnsons.com | Custom throwaway email domain shared across all five npm maintainer accounts (one unique random local-part per package). Strongest cluster fingerprint for this operator. | 1 | |
| emailavu2mglrijzlnu4ujkca@deltajohnsons.com | procwire maintainer email. | 1 | |
| emailsg5kcaiezwyf9umsphqc@deltajohnsons.com | routecraft maintainer email. | 1 | |
| emailhmlfyhj29biz62gkvxbh@deltajohnsons.com | endpointmap maintainer email. | 1 | |
| emaildstc2xvtq7fszbvmbvic@deltajohnsons.com | bytecraft maintainer email. | 1 | |
| emailynn47wq89mvauxti9zgf@deltajohnsons.com | staticlayer maintainer email. | 1 | |
| emailakuznetsov-dev@protonmail.com | Invented author persona 'Anton Kuznetsov' (akuznetsov-oss org packages: procwire, routecraft). | 1 | |
| emailvpetrov-node@protonmail.com | Invented author persona 'Viktor Petrov' (vpetrov-oss org packages: bytecraft, endpointmap, staticlayer). | 1 | |
| github repoakuznetsov-oss | Fabricated GitHub organization (now 404) for procwire and routecraft. | 1 | |
| github repovpetrov-oss | Fabricated GitHub organization (now 404) for bytecraft, endpointmap, staticlayer. | 1 | |
| file pathlib/setup.js | procwire preinstall entrypoint: win32 guard, name-derived XOR key, C2 decode, worker.init(). | 1 | |
| file pathlib/registry.js | endpointmap metadata-only C2 store: XOR-encoded _ep and _p byte arrays disguised as endpoint constants. | 1 | |
| domainolrh4mibs62l6kkuvvjyc5lrercqg5tz543r4lsw3o6mh5qb7g7sneid.onion | Tor hidden-service C2 for the Atomic Arch implant. Beacon POST /api/agent HTTP/1.0; secondary-payload staging at /bin/linux with hash verification at /bin/sha256/linux. Onion host is XOR-obfuscated in the binary (32-byte repeating key at offset 0x1AA60, 62-byte ciphertext at 0x2DA96). Same /api/agent beacon path as IronWorm. | 1 | |
| sha2566144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b | Dropper ELF inside atomic-lockfile@1.4.2 (./src/hooks/deps). Stripped Rust-async Linux ELF64 PIE, entry 0xeae00, 3,040,376 bytes. MD5 42b59fdbe1b72895b2951412222ebf40. | 1 | |
| md542b59fdbe1b72895b2951412222ebf40 | MD5 of the atomic-lockfile dropper ELF (./src/hooks/deps). | 1 | |
| sha2567883bda1ff15425f2dbe622c45a3ae105ddfa6175009bbf0b0cad9bf5c79b316 | Linux ELF payload embedded in the js-digest npm package (Atomic Arch wave-2 / bun-delivered variant). | 1 | |
| sha25647893d9badc38c54b71321263ce8178c1abb10396e0aadf9793e61ec8829e204 | Secondary payload fetched from the Tor C2 at /bin/linux (verified against /bin/sha256/linux). Suspected cryptominer; detection hint is modification of /usr/bin/monero-wallet-gui. | 1 | |
| file pathsrc/hooks/deps | Path of the Rust-async ELF infostealer dropper inside the atomic-lockfile npm tarball; invoked by the package.json preinstall hook (preinstall: ./src/hooks/deps). | 1 | |
| file pathscales.bpf.c | eBPF rootkit component source filename. Hooks getdents64() to hide PIDs from /proc, filenames from directory listings, and socket inodes from /proc/net/tcp + netlink (NETLINK_SOCK_DIAG). Pinned BPF maps /sys/fs/bpf/hidden_pids, /sys/fs/bpf/hidden_names, /sys/fs/bpf/hidden_inodes. Kills ptrace (PTRACE_ATTACH/PTRACE_SEIZE). IronWorm equivalent was q2.bpf.c. | 1 | |
| github repofardewoak/nodejs-argo | GitHub repo hosting a container image (ghcr.io herbsobering430) tied to the npm publisher herbsobering; appears to be reverse-shell / proxy tooling associated with the Atomic Arch operator. | 1 | |
| urlhttps://o4511539639222272.ingest.de.sentry.io/api/4511539669368912/envelope/ | Sentry ingest (envelope) endpoint abused as the C2/exfiltration drop. build.rs POSTs stolen git metadata and source diffs here via curl. Sentry org ID o4511539639222272, project ID 4511539669368912, region host ingest.de.sentry.io. | 0 | |
| domaino4511539639222272.ingest.de.sentry.io | Region-pinned Sentry ingest host (org subdomain o4511539639222272, EU/de region) used for exfiltration. | 0 | |
| file pathbuild.rs | Cargo build script added to the crate; executes at compile time on the consumer machine and performs the data collection and exfiltration. | 0 | |
| urlhttps://8197ee42c4f59c83f4cc6d48f5bae821@o4511539639222272.ingest.de.sentry.io/4511539669368912 | Full Sentry DSN embedded in the envelope 'dsn' field. The public key 8197ee42c4f59c83f4cc6d48f5bae821 is the most specific attributable indicator in the payload (distinct from the bare ingest URL). DSN form: https://<public_key>@o<org>.ingest.<region>.sentry.io/<project_id>. Hunt for the literal key 8197ee42c4f59c83f4cc6d48f5bae821 in package sources and outbound traffic. | 0 | |
| file pathCargo.toml | Dependency-level indicator: the malicious commit adds a build-dependency 'uuid = { version = "1.23", default-features = false, features = ["v4"] }' to Cargo.toml, used for Uuid::new_v4().as_simple() to generate the Sentry event_id. An otherwise-unexpected 'uuid' build-dep appearing alongside a new build.rs is a strong combined signal. | 0 | |
| sha25651b4dd39a15af1e28e97adc375849d688423ec3d88e8010644395fcdea52a3cc | core/telemetry/_hooks.py — Python stager injected into gpt-pilot; derived from edxeth/Shai-Hulud-Open-Source PYTHON_LOADER.py | 1 | |
| sha256c96f37e1b9cdc9683a300909492ed9f770b620d0037e5b80e23753cba7ca4077 | core/telemetry/_runtime.bin — 758 KB Bun JS payload with // @bun @bun-cjs header, MxGPr9 string-array rotation obfuscation, fromCodePoint decoder | 1 | |
| file pathcore/telemetry/_hooks.py | Python stager file path in compromised gpt-pilot repository | 0 | |
| file pathcore/telemetry/_runtime.bin | Bun JS payload file path; .bin extension used to blend with compiled asset naming conventions | 0 | |
| file pathcore/telemetry/.loader.lock | Run-once lock file; presence indicates prior stager execution on the host | 1 | |
| github repoedxeth/Shai-Hulud-Open-Source | Attacker toolkit repository (created 2026-05-13); contains src/assets/PYTHON_LOADER.py — the template for the gpt-pilot stager | 1 | |
| github repodeadbeef3137/Shai-Hulud-Open-Source | Fork of attacker toolkit edxeth/Shai-Hulud-Open-Source | 0 | |
| file pathtools/setup | ~976 KB UPX-packed Rust ELF infostealer binary dropped inside the malicious npm tarball; invoked by the package.json preinstall hook (preinstall: ./tools/setup). | 1 | |
| file path.github/scripts/precheck | Alternate in-repo path for the IronWorm Rust binary dropper, committed under the spoofed claude author identity. | 1 | |
| file pathq2.bpf.c | eBPF rootkit component source filename recovered from .BTF.ext debug metadata left in the embedded ELF object (214 verbatim source lines). Provides process hiding (/proc rewriting), TCP socket hiding (netlink filtering), and anti-debugging (ptrace interception, SIGKILL). | 1 | |
| urlhttp://127.0.0.1:8738 | Local loopback HTTP listener used to capture wallet credential POSTs (Exodus desktop wallet password + BIP-39 seed mnemonic injected from the browser/app). | 1 | |
| urlhttps://temp.sh | Fallback exfiltration host (public file-sharing service), reached over Tor via POST /upload when the primary Tor hidden-service C2 is unavailable. Same fallback as IronWorm. | 2 | |
| urltor://api/agent | Primary C2 beacon path /api/agent served over a Tor hidden service (.onion address not published by the researcher). Provides remote shell plus file download/execute. Tor reached via custom torrc + downloaded Tor expert bundle. | 1 | |
| urlhttps://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package | npm OIDC Trusted Publishing token-exchange endpoint abused for self-replication: mints a package-scoped automation token without stored credentials, then republishes trojanized versions. | 1 | |
| wallet0x7e28D9889f414B06c19a22A9Bd316f0AC279a4d6 | Operator's own Ethereum wallet, derived from a hardcoded BIP-39 recovery phrase ('bench crane defense corn wheel trial news abuse finish better paddle slush') left inside the binary and present in the malware's wallet skip-list. Near-empty test wallet; an OPSEC failure that aids attribution. | 1 | |
| github repoasteroid-dao/eternal-storage | Victim GitHub repo poisoned by IronWorm. Malicious commit SHA a8f0c75a77698759413dbadcb99b62709816ed42 (backdated, spoofed claude author). | 1 | |
| github repoasteroid-dao/asteroid-protocol | Victim GitHub repo poisoned by IronWorm. Malicious commit SHA 5d7c93caf50a447a8d48cafe2e5cff6b47618b13. | 1 |