Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| sha2569e570641fd815e2fd6cf50aaa847c43c2fe938c7b368bf7c239f511827ff9a24 | SHA-256 of zod-pino434 v1.0.128 tarball (Wave 4, latest known version) | 1 | |
| sha25693817e263f285f20ed213eb07bbab2857493183c0abf9563facfc65fdd4467f7 | SHA-256 of zod-pino444 v1.0.128 tarball (Wave 4) | 1 | |
| sha2561d4ef70d7856704b373579ae23cba0ebf690ef062b29361f6aa0f51a1cdd9052 | SHA-256 of zod-pino444 v1.0.131 tarball (Wave 4, latest known version) | 1 | |
| emaildonimiqueakers@gmail.com | npm account email for donimique, publisher of zod-pino434, zod-pino444, zredis-typed, pinokio-redis (Wave 4) | 1 | |
| sha256a1853a45bcb561f96e0e7c0dec7f96e640ae53be62e65158880812ff104c9e41 | SHA-256 of zredis-typed v1.0.127 tarball (Wave 4, only known version) | 1 | |
| sha256a400b0342add77fd3a58e086334b35e11d79e234b180bb360f48adcd61ec4acd | SHA-256 of pinokio-redis v1.0.127 tarball (Wave 4, only known version; user-confirmed all versions malicious) | 1 | |
| domainpolymarketbot.polymarketdev.workers.dev | Network indicator from blog post | 1 | |
| sha256e01b85c1437085a519217338fe4ee5ed7858c28a10f8c1477b2f1857c3386edb | SHA-256 hash from blog post | 1 | |
| emaildmtnatpepes@proton.me | Email indicator from blog post | 1 | |
| domainutaq.cfww.shop | Former Coruna exploit kit host (Phase 2). 180.178.50.158 AS45753 Netsec Limited HK. Hosted 14 exploit modules (606KB) at /gooll/. DEAD as of 2026-07-03. | 1 | |
| domaingit.youzzjizz.com | Former payload host (Phase 1, version 4.13.3). String.fromCharCode decoded URL. DEAD as of 2026-07-03. | 1 | |
| ipv4180.178.50.158 | IP for utaq.cfww.shop (former Coruna exploit kit host, Phase 2). AS45753 Netsec Limited, Hong Kong. DEAD. | 1 | |
| ipv4172.67.141.14 | Cloudflare IP for l1ewsu3yjkqeroy.xyz (former C2 sync, Phase 2). DEAD. | 1 | |
| ipv4104.21.40.254 | Cloudflare IP for l1ewsu3yjkqeroy.xyz (former C2 sync, Phase 2). DEAD. | 1 | |
| sha256273206e2973df6ba7474aa66693797c98dcf26b794da4c3e863ab8d8c694868d | art-template@4.13.3 npm tarball (Phase 1) | 1 | |
| sha2565b5fe5d92808a732d0d44246cd706295cc739ed7f4dcae19112df666bc5d4f7d | art-template@4.13.5 npm tarball (Phase 2, unpublished from npm) | 1 | |
| sha256101afde88ff8b5c02fd341eda55022a39203088c2ff11dcb73214911cf5afb77 | art-template@4.13.6 npm tarball (Phase 2, unpublished from npm) | 1 | |
| sha256d8e3973a0b3c5359d1f53a22491b56bdd31dee13a51c01c7126bc6694584512f | Original Coruna exploit kit payload served from v3.jiathis.com/code/jia.js (Phase 2, no longer served) | 1 | |
| sha256f31bdd069fe7966ae11be1f78ee5dd44445938856dd1df12379e0e84a6851f5c | 49554fde7424c31c.js stage-4 Coruna malware loader (50KB, Phase 2) | 1 | |
| sha157620206d62079baad0e57e6d9ec93120c0f5247 | SHA-1/commit-like hash from blog post | 1 | |
| sha114669ca3b1519ba2a8f40be287f646d4d7593eb0 | SHA-1/commit-like hash from blog post | 1 | |
| md57d86eb847ecfd3c972fa457a6abaa0da | MD5 hash from blog post | 0 | |
| emailgoofychris69@gmail.com | Persistent maintainer account (daughtrymom). Controls art-template, express-art-template, art-template-loader, koa-art-template across all phases. | 1 | |
| emailnpmpacketmaintainmember7@proton.me | Phase 2 publisher account (npmpacketmaintainmember7). Published 4.13.5 and 4.13.6. Removed from maintainers after Phase 3. | 1 | |
| domaincheck.git-service.com | Network indicator from blog post | 1 | |
| domainwww.youtube.com | Network indicator from blog post | 1 | |
| ipv4160.119.64.3 | IP address indicator from blog post | 1 | |
| ipv4185.95.159.32 | IP address indicator from blog post | 1 | |
| sha2563de04fe2a76262743ed089efa7115f4508619838e77d60b9a1aab8b20d2cc8bf | SHA-256 hash from blog post | 1 | |
| sha25685f54c089d78ebfb101454ec934c767065a342a43c9ee1beac8430cdd3b2086f | SHA-256 hash from blog post | 1 | |
| sha256c0b094e46842260936d4b97ce63e4539b99a3eae48b736798c700217c52569dc | SHA-256 hash from blog post | 1 | |
| sha256069ac1dc7f7649b76bc72a11ac700f373804bfd81dab7e561157b703999f44ce | SHA-256 hash from blog post | 1 | |
| domaint.m-kosche.com | Network indicator from blog post | 1 | |
| ipv4169.254.170.2 | AWS ECS task metadata endpoint queried for credentials | 2 | |
| sha256a68dd1e6a6e35ec3771e1f94fe796f55dfe65a2b94560516ff4ac189390dfa1c | SHA-256 hash from blog post | 1 | |
| sha11916faa365f2788b6e193514872d51a242876569 | SHA-1/commit-like hash from blog post | 1 | |
| sha17cb42f57561c321ecb09b4552802ae0ac55b3a7a | SHA-1/commit-like hash from blog post | 1 | |
| sha1dc3d62a2181beb9f326952a2d212900c94f2e13d | SHA-1/commit-like hash from blog post | 1 | |
| ipv41.1.1.1 | IP address indicator from blog post | 1 | |
| ipv48.8.8.8 | IP address indicator from blog post | 1 | |
| sha256449e4265979b5fdb2d3446c021af437e815debd66de7da2fe54f1ad93cbcc75e | SHA-256 hash from blog post | 1 | |
| sha256c2f4dc64aec4631540a568e88932b61daebbfb7e8281b812fa01b7215f9be9ea | SHA-256 hash from blog post | 1 | |
| sha25678a82d93b4f580835f5823b85a3d9ee1f03a15ee6f0e01b4eac86252a7002981 | SHA-256 hash from blog post | 1 | |
| sha2563427a90c8cb9af764445448648176e120ebc6af0a538158340cf6220de4d01b7 | SHA-256 hash from blog post | 1 | |
| sha256fdba4191831a13debf9d8c0c940b0301c7b7f01d27f1b1c73ed3ceaa2db4103b | SHA-256 hash from blog post | 1 | |
| ipv4207.90.194.2 | IP address indicator from blog post | 1 | |
| sha18daaa2003784a92f4761ed3c9d5560ef8cf4bffa | SHA-1/commit-like hash from blog post | 1 | |
| md5b604b21749a396111bb111d46d97b1c4 | MD5 hash from blog post | 1 | |
| domaingit-tanstack.com | Network indicator from blog post | 1 | |
| domainfilev2.getsession.org | Network indicator from blog post | 1 |