Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| ipv4166.88.134.75 | Branch B (0xa322) C2 2026-09-17 to 2026-09-28. AS149440 Evoxt. | 1 | |
| ipv491.218.183.174 | Branch B (0xa322) C2 from 2026-09-28. AS149440 Evoxt. | 1 | |
| urlhttp://198.105.127.210:443/boot | Branch A stage 3 boot script (plain HTTP on port 443), fetched with header X: 33ff3edaf55a8e03dcbc7cb40d498a49:<marker>. '-skipwarn' in argv is a kill switch. | 1 | |
| urlhttp://198.105.127.210:443/init | JSON {_U,_H,_B,_Z}; eval(_B). _B is a 74.8 KB LZString blob and _Z (/*RS260605*/) re-runs the dead-drop lookup. Neither fully analyzed. | 1 | |
| urlhttp://45.137.198.133/0/boot | Branch A second boot script. Fetches /0/body. | 1 | |
| urlhttp://45.137.198.133/0/body | XOR-encoded Node stealer (key YU7m{rE/>|==b>#~). Installs axios and socket.io-client to ~/.node_modules and bootstraps Python. | 1 | |
| urlhttp://45.137.198.133/snv | Exfiltration endpoint for the full process.env (id=<host>$<user>). | 1 | |
| urlhttp://45.137.198.133/$/1 | Python infostealer build 260924 (lock file tmp7A863DD1.tmp). Exfiltrates to {_target}/u/e and /u/f with Telegram sendDocument fallback. | 1 | |
| sha25602b7e072c51ac6f7037c2fd4727fcdb06bee6f74cc1af182f7180d8b5e904d63 | PolinRider Ethereum generation: /boot response from 198.105.127.210 | 1 | |
| sha25684a3f1bd81ae4780776c93f9a5ec1cb0d7d6fb613f4a104cceaa93568bdbd0ab | PolinRider Ethereum generation: /0/boot response from 45.137.198.133 | 1 | |
| sha2565cbcb8e11f6152c80cf88f752bcf9cb1077a88eac5e4eb02471f093248db01ac | PolinRider Ethereum generation: /init JSON response from 198.105.127.210 | 1 | |
| sha256f6d9f2fbf8091f431a802c4a0b8a5661278ee3f0854fb9040a0702e894b2309e | PolinRider Ethereum generation: /0/body response (XOR encoded) from 45.137.198.133 | 1 | |
| sha2563be09f8c0a95f993a0ee99e08dca08eb15e1c0abeaf90b190a76e842028e552b | PolinRider Ethereum generation: Python infostealer from 45.137.198.133/$/1 | 1 | |
| file path/tmp/tmp7A863DD1.tmp | PolinRider Ethereum generation: Python infostealer lock file (Linux and macOS) | 1 | |
| file path%LOCALAPPDATA%\Temp\tmp7A863DD1.tmp | PolinRider Ethereum generation: Python infostealer lock file (Windows) | 1 | |
| file path~/.node_modules | PolinRider Ethereum generation: Private npm prefix where the Node stealer installs axios and socket.io-client | 1 | |
| file path/tmp/.pip | PolinRider Ethereum generation: Fallback pip install target used by the Python bootstrap | 1 | |
| domainskyleen.fr | sckit campaign parent domain. All subdomains are campaign infrastructure. Registered 2026-09-15; wildcard DNS to 127.0.0.1 observed 2026-09-23. | 1 | |
| domain8a8acaf167b3.skyleen.fr | sckit C2 front for campaign cloud-openclaw-semi-nuclear (npm). Paths /<24 hex>/config, /status, /batch. | 1 | |
| domain0b48fafd6fbe.skyleen.fr | sckit C2 front for campaign cloud-openclaw-semi-nuclear (npm). Paths /<24 hex>/config, /status, /batch. | 1 | |
| domain266297c6df27.skyleen.fr | sckit C2 front for campaign cloud-openclaw-semi-nuclear (npm). Paths /<24 hex>/config, /status, /batch. | 1 | |
| domainc747d139e7e9.skyleen.fr | sckit C2 front for campaign memos-semi-nuclear (PyPI). Paths /<24 hex>/config, /status, /batch. | 1 | |
| domain73376a079d87.skyleen.fr | sckit C2 front for campaign memos-semi-nuclear (PyPI). Paths /<24 hex>/config, /status, /batch. | 1 | |
| domaind4f77a3a8cb0.skyleen.fr | sckit C2 front for campaign memos-semi-nuclear (PyPI). Paths /<24 hex>/config, /status, /batch. | 1 | |
| domain10729e014d0e.skyleen.fr | sckit CI delivery host for memos-semi-nuclear (signed index + emitter binary download during the PyPI token-capture run). | 1 | |
| urlhttps://10729e014d0e.skyleen.fr/eb57efaa7365698fc1e4decc/initial-ci-v2 | Base URL passed by src/memos/_pypi_bridge.sh to _initial_ci_delivery.py during the PyPI publish step. Delivery paths /index/<64 hex>, /file/<64 hex>/<64 hex>, /observe/<64 hex>. | 1 | |
| emailci-review@memtensor.invalid | Fabricated commit author identity "MemTensor CI Review" on malicious MemTensor/MemOS commit b52958f (.invalid TLD, not a real mailbox). Detect in git history. | 1 | |
| file path$HOME/.openclaw/.cache/runtime | sckit state directory for campaign cloud-openclaw-semi-nuclear. | 1 | |
| file pathlib/sckit.js | npm loader module (launchStageZero / collectStageZero) in the malicious plugin versions. | 1 | |
| file path.github/scripts/sckit-publish-bridge.sh | CI bridge sourced via BASH_ENV in the npm publish step; passes NPM_TOKEN to sckit, deletes itself, exits 1. Commit 9b97ec6. | 1 | |
| file path$HOME/.memos/.cache/runtime | sckit state directory for campaign memos-semi-nuclear. | 1 | |
| file pathmemos/_stage0.py | Python loader (trigger()) called from memos/log.py configure_logging() in MemoryOS 2.0.34. | 1 | |
| file pathsrc/memos/_pypi_bridge.sh | CI bridge sourced via BASH_ENV inside pypa/gh-action-pypi-publish; forwards INPUT_PASSWORD to the CI delivery script. Commit b52958f. | 1 | |
| file pathsckit_poetry_build.py | In-tree Poetry build backend (backend-path ["."]) that writes BASH_ENV=src/memos/_pypi_bridge.sh to GITHUB_ENV on import. Commit b52958f. | 1 | |
| file pathruntime-update.yml | Name found in the sckit binary; inferred (not confirmed) to be the file name of the worm's push-triggered GitHub Actions template that runs sckit stage0. | 1 | |
| sha256381ac6dc1715d9298fe81b2a53a11f7b7d78e361ee3a6619ad54f8c4b062cc18 | sckit implant linux-amd64 (ELF/Mach-O), campaign cloud-openclaw-semi-nuclear, shipped in npm @memtensor/memos-cloud-openclaw-plugin 0.1.21-0.1.25 under .sckit/linux-amd64/. | 1 | |
| sha256e077c387b223811064b7bbc5a55a0182fca9bf50894f949ff284d4be87d44b26 | sckit implant linux-arm64 (ELF/Mach-O), campaign cloud-openclaw-semi-nuclear, shipped in npm @memtensor/memos-cloud-openclaw-plugin 0.1.21-0.1.25 under .sckit/linux-arm64/. | 1 | |
| sha25665faf8ccbcf5b34eb4f72c71bf82815fa9c1e2f947b9c898491540e866132c31 | sckit implant darwin-amd64 (ELF/Mach-O), campaign cloud-openclaw-semi-nuclear, shipped in npm @memtensor/memos-cloud-openclaw-plugin 0.1.21-0.1.25 under .sckit/darwin-amd64/. | 1 | |
| sha256f8ccdd1da7dff1aef16377a2842bc7acf7c516e32122dd6e42dc4a4e57653fce | sckit implant darwin-arm64 (ELF/Mach-O), campaign cloud-openclaw-semi-nuclear, shipped in npm @memtensor/memos-cloud-openclaw-plugin 0.1.21-0.1.25 under .sckit/darwin-arm64/. | 1 | |
| sha25656cd3416d2ec2aa7e7cec2a06010cf0b58eb09c0a5486809df52afeaca8f14be | sckit implant windows-amd64 (.exe), campaign cloud-openclaw-semi-nuclear, shipped in npm @memtensor/memos-cloud-openclaw-plugin 0.1.21-0.1.25 under .sckit/windows-amd64/. | 1 | |
| sha256d6b3e77c36ee8017c9bf30d1da7218ec0ea843768d313eb8e35845c8a9b38a26 | sckit implant windows-arm64 (.exe), campaign cloud-openclaw-semi-nuclear, shipped in npm @memtensor/memos-cloud-openclaw-plugin 0.1.21-0.1.25 under .sckit/windows-arm64/. | 1 | |
| sha256c1b0998347b489582bae7b7f4930f9831d9ef4b6bc150cfd488ee1a43272dd36 | sckit implant linux-amd64 (ELF/Mach-O), campaign memos-semi-nuclear, shipped in PyPI MemoryOS 2.0.34 under .sckit/linux-amd64/. Same hash as the emitter pinned by _pypi_bridge.sh (--emitter-sha256) and run in initial-ci-emit mode. | 1 | |
| sha2568f647f17a1934679c4095e21bee2b9bd83e28476603758bc91408a0c8443e3b4 | sckit implant linux-arm64 (ELF/Mach-O), campaign memos-semi-nuclear, shipped in PyPI MemoryOS 2.0.34 under .sckit/linux-arm64/. | 1 | |
| sha2569de0d5b0ca184f71f630be5781d134998883a02d5d7bc65aeb9559d8f9efb364 | sckit implant darwin-amd64 (ELF/Mach-O), campaign memos-semi-nuclear, shipped in PyPI MemoryOS 2.0.34 under .sckit/darwin-amd64/. | 1 | |
| sha2565405e330507602e803f7dd6f2a9d4555aec8558ab222b51413594a962da6888a | sckit implant darwin-arm64 (ELF/Mach-O), campaign memos-semi-nuclear, shipped in PyPI MemoryOS 2.0.34 under .sckit/darwin-arm64/. | 1 | |
| sha25616de381deb978744535b10f68fe15165251374b86eef18ffc2c47f61ea673047 | sckit implant windows-amd64 (.exe), campaign memos-semi-nuclear, shipped in PyPI MemoryOS 2.0.34 under .sckit/windows-amd64/. | 1 | |
| sha256f7c4014e284f3d56c452b8b222a287c54f73dc4a40a7e022e765ac8376362947 | sckit implant windows-arm64 (.exe), campaign memos-semi-nuclear, shipped in PyPI MemoryOS 2.0.34 under .sckit/windows-arm64/. | 1 | |
| wallet0x906f019AC38bB572a8f7d8b2cA662D624EDebaff | Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| wallet0x2707BbD5CF9b2F7cE37e4913BADC0349272d48cf | Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| wallet0x2a8536AdA44816Cb049778d24b75d795987D90b1 | Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 |