Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| domainjira.t-in-one.io | Fabricated Jira domain in @t-in-one README. Social engineering artifact; not confirmed functional. | 0 | |
| sha25623ccdefb9b917373a4b723d8d482eb6b8880e7e45b0d21cfa5d21d5c27da4918 | SHA256 of the @t-in-one/add_application@5.7.1 npm tarball (registry.npmjs.org). Sample Wave 2 artifact. | 0 | |
| domaincopilot-ai.whisdev.org | Secondary hostname on C2 IP 195.201.194.107. Linked to bink/ptc-bink/whisdev persona cluster (JFrog attribution). | 1 | |
| domainsha256-validate-rpc.vercel.app | Contagious Trader exfil endpoint used by polymarket-validator (toskypi, Feb 2026) | 1 | |
| domainchangelog.rest | Contagious Trader exfil endpoint used by changelog-logger-utilities (toskypi, Mar 2026) | 1 | |
| domainpolblxpnl.space | Contagious Trader C2 domain | 0 | |
| sha256b2954c945b51dbd6fa88ac72338b7fbf76dec7d9909ceada9d36b21330842c97 | MicrosoftSystem64 Linux ELF binary (81 MB Node.js SEA, v1.0.8) | 1 | |
| emailtosky.pi1016@gmail.com | npm account toskypi, linked to ~20 DPRK npm accounts per kmsec.uk. Published polymarket-validator, changelog-logger-utilities. Famous Chollima. | 1 | |
| urlhttps://huggingface.co/jpeek998/system-releases/resolve/main | Binary update URL for MicrosoftSystem64 self-update (24h interval) | 1 | |
| urlhttps://huggingface.co/Lordplay/system-releases | Original binary hosting repo on HuggingFace (disabled by HF, account Lordplay created 2025-11-24). Shared by jpeek868/886/895 cluster. | 1 | |
| urlhttps://huggingface.co/jpeek998/linux_doc_75a5ffec36ca | Third victim dataset: 48 screenshot files, started 2026-05-28T06:10:24Z. Active compromise evidence. | 1 | |
| file path~/.local/share/MicrosoftSystem64 | Linux install directory for MicrosoftSystem64 binary and state files | 1 | |
| file path~/.pcl-state/uploads.json | Screenshot upload state tracker for HuggingFace exfiltration | 1 | |
| domainoob.moika.tech | Shared C2 host across all three waves. Hosts /report exfiltration endpoint and /payload/{platform} second-stage scripts. Wave 3 platform strings: linux-x64, darwin-arm64, win. | 1 | |
| urlhttps://oob.moika.tech/report | Exfiltration endpoint. Receives HTTP POST with process.env, hostname, username, platform, arch, cwd, Node.js version, and X-Secret authentication header. | 1 | |
| urlhttps://oob.moika.tech/payload/mac.js | Second-stage payload for macOS, fetched by postinstall hook on darwin systems. | 1 | |
| urlhttps://oob.moika.tech/payload/win.js | Second-stage payload for Windows, fetched by postinstall hook on win32 systems. | 1 | |
| urlhttps://oob.moika.tech/payload/linux.js | Second-stage payload for Linux, fetched by postinstall hook on linux systems. | 1 | |
| file path._cloudplatform-single-spa_init.js | Temp file written by the postinstall hook when downloading the second-stage payload. Written to the OS temp directory (os.tmpdir()). Name is consistent across all packages regardless of scope. | 1 | |
| domaintelemetry.car-loans.io | Fabricated telemetry domain appearing only in @car-loans scope README text. Social engineering artifact — not confirmed functional C2. Declared opt-out: CAR_LOANS_NO_TELEMETRY=1. Actual exfiltration target is oob.moika.tech. | 1 | |
| domaintelemetry.cloudplatform-single-spa.io | Fabricated telemetry domain appearing only in @cloudplatform-single-spa scope README text. Social engineering artifact — not confirmed functional C2. Declared opt-out: CLOUDPLATFORM_SINGLE_SPA_NO_TELEMETRY=1. Actual exfiltration target is oob.moika.tech. | 1 | |
| domainnpm.car-loans.io | Fabricated private npm registry domain in @car-loans README and .npmrc comment (registry=https://npm.car-loans.io). Social engineering artifact confirming target org uses a private npm registry — the precondition for dependency confusion. Not confirmed functional infrastructure. | 1 | |
| domainnpm.cloudplatform-single-spa.io | Fabricated private npm registry domain in @cloudplatform-single-spa README. Social engineering artifact confirming target org uses a private npm registry. Not confirmed functional infrastructure. | 1 | |
| domain21baseballacademy.com | Ad script delivery domain used by terminal3airport packages. Hosts external JS payload at cdn.21baseballacademy.com. | 0 | |
| domainabdct.com | Popunder redirect destination triggered by adware in terminal3airport packages. | 0 | |
| domainwoofbeginner.com | Additional ad/monetization script host used by terminal3airport packages. | 0 | |
| urlhttps://cdn.21baseballacademy.com/script/jrqK2HPsliMjRW5Q.js | External ad script injected into proxy pages by terminal3airport packages. | 0 | |
| urlhttps://woofbeginner.com/0a/91/35/0a913561831bdf2c26dcf18b852b5cc1.js | Additional monetization script loaded by terminal3airport adware. | 0 | |
| emailadofhiter23@gmail.com | npm maintainer email for terminal3airport account. Published all 141 malicious packages. | 0 | |
| github repolucideproxy/svg | GitHub repository referenced in package source code. Associated with Lucide Proxy project. | 0 | |
| sha2560d27f455ae056aa908c276d9b17a73d469227257838ec9bcbcb3f1c66169b5a4 | SHA-256 of obfuscated JS file a3g0q43tbe.js found in wave 2-3 packages. | 0 | |
| urlws://204.10.194.247:9877 | WebSocket C2 relay endpoint for forge-jsx RAT campaign | 1 | |
| urlhttp://204.10.194.247:8765 | HTTP API endpoint for forge-jsx RAT campaign | 1 | |
| emailjacksonkaandorp2@outlook.com | npm account email for jacksonkaandorp2, publisher of forge-jsxy (Wave 2) | 1 | |
| emailrafaelsilva19930303@gmail.com | npm account email for rafael_silva, publisher of forge-jsx4 (Wave 3) | 1 | |
| domaintaohunter.ai | Domain associated with johntaohunter npm account (Wave 1) | 1 | |
| sha2564938d47fe6216f8f9fee0527bf5112c04c15a9ea62f87869677619aa5400f09f | SHA-256 of forge-jsxy v1.0.91 (latest Wave 2 version) | 1 | |
| sha2568070daba5d6ca61c357574526d1e0f468ae575a4edf74cc90a8d8b8c78e3aeef | SHA-256 of forge-jsxy v1.0.66 (first Wave 2 version) | 1 | |
| sha2566321dacc21675f81c4cee7db8434ca4cf0e228d3b592bde26a0a40f223dbb00e | SHA-256 of forge-jsx4 v1.0.123 tarball (Wave 3) | 1 | |
| file path~/.config/systemd/user/forge-js-worker.service | Linux systemd persistence for forge-jsx RAT | 1 | |
| file path~/.config/autostart/forge-js-worker.desktop | Linux XDG autostart persistence for forge-jsx RAT | 1 | |
| file path~/Library/LaunchAgents/com.forgejs.worker.plist | macOS LaunchAgent persistence for forge-jsx RAT | 1 | |
| ipv4212.193.3.61 | New C2 IP introduced in Wave 3 parallel packages (pino-zod, zod-pino). AS unknown. WebSocket relay port 9877, HTTP API port 8765. Rotated from 204.10.194.247. | 1 | |
| urlws://212.193.3.61:9877 | WebSocket C2 relay endpoint for forge-jsx RAT Wave 3 parallel packages (pino-zod, zod-pino) | 1 | |
| urlhttp://212.193.3.61:8765 | HTTP API endpoint for forge-jsx RAT Wave 3 parallel packages (pino-zod, zod-pino) | 1 | |
| sha2560eb72e0794c7e51ca1d790c443b5f573e1288bad6e6c56d1bd9c4b69a71d65d0 | SHA-256 of pino-zod v1.0.122 tarball (Wave 3 parallel) | 1 | |
| sha2561f7616b3c38f85860abd9ae989d72915e9c13f0d106804471a811a38d63e5293 | SHA-256 of zod-pino v1.0.125 tarball (Wave 3 parallel, latest known version) | 1 | |
| sha2560085d5b5d4a2bbb3fd1f38e6b251872d4f753aa8f1ac7f20524c521ff5ca5933 | SHA-256 of compose-logger-stand v1.0.126 tarball (Wave 4 bridge package) | 1 | |
| emailjacksonkaandorp_3@outlook.com | npm account email for jacksondkeindlson, publisher of compose-logger-stand (Wave 4 bridge). Variant of Wave 2's jacksonkaandorp2@outlook.com handle pattern. | 1 | |
| sha256a99be9fe0e7d66064a11ee096fd8c1a9178e3ee2b761fa8a2bde81bfe846b9a2 | SHA-256 of zod-pino434 v1.0.127 tarball (Wave 4, first package with rotated AES key) | 1 |