Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| wallet0x4C0c9B92BB9647fAf45022BA55f02bB0950196de | Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| wallet0xDe34270921D37124fd0b64ea3aE4c5062B467418 | Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| wallet0x315d47b401aC29e97893dec1c85aBBB2791ef2aA | Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| wallet0x475B8659A33FB0C2bDB4c60ffdb92bC24d5c4015 | Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| wallet0xd5A4620278788AcCf388B7Ea5f35f849465728E7 | Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| wallet0x4b225b742eb31AD0DfD6bc00F8C55650b4394c18 | Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| wallet0x661e50E19f05E3c0d04fD75891456D1F0A24508D | Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| wallet0xc0445F1b679DC46280A0f03F451bdf613b5A0feA | Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| wallet0x9E4dF8F253Eb439dd9538Fda30cC03B38fD3a631 | Smart contract C2, Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| wallet0xE390863Dac96a7118C71227C2b099B50cF602D31 | Deployment B smart contract C2, Ethereum Sepolia (SafeDep-confirmed; mathsbase@1.0.1) | 1 | |
| wallet0xac0bfC4C48A679b667732128278EACBA1c191894 | Deployment A smart contract C2, Base Sepolia (SafeDep-confirmed; mathmain + math-universe) | 1 | |
| urlhttps://base-sepolia.infura.io/v3/dc7257d09fab42eca2c354c32fec1938 | Deployment A RPC (Infura), Base Sepolia (SafeDep-confirmed) | 1 | |
| urlhttps://base-sepolia.g.alchemy.com/v2/D2-TbkB2m05WXSnSDOCDI | Deployment A RPC (Alchemy), Base Sepolia (SafeDep-confirmed); shared Alchemy project key | 1 | |
| urlhttps://eth-sepolia.g.alchemy.com/v2/D2-TbkB2m05WXSnSDOCDI | Deployment B RPC (Alchemy), Ethereum Sepolia (SafeDep-confirmed); same Alchemy project key as Deployment A | 1 | |
| urlhttps://eth-sepolia.g.alchemy.com/v2/0E6xblLeXLnZSnn280R-O | RPC (Alchemy), Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| urlhttps://sepolia.infura.io/v3/d3d6e819028346a0b973bd5dd371c468 | RPC (Infura), Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| urlhttps://sepolia.infura.io/v3/dc7257d09fab42eca2c354c32fec1938 | RPC (Infura), Ethereum Sepolia; same Infura key as Deployment A (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| urlhttps://eth-sepolia.g.alchemy.com/v2/NObVGNvMv3xNnlHDx3QYc | RPC (Alchemy), Ethereum Sepolia (reported by external campaign tracking, not independently verified by SafeDep) | 1 | |
| telegram bot8961878831 | Deployment A Telegram bot (SafeDep-confirmed; chats -1003952553968, -1004489630130) | 1 | |
| telegram bot8717417715 | Telegram bot (chat -1003968723972) (reported, not independently verified by SafeDep) | 1 | |
| telegram bot8836581068 | Telegram bot (operator monitoring, alerts to @server_alert_0630) (reported, not independently verified by SafeDep) | 1 | |
| emailtinystar368@proton.me | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailelenahorn97@proton.me | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailallennightgale0812@outlook.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emaillin.n.ping@proton.me | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailhunterhicks18@proton.me | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailjamesmorse82@proton.me | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailmona.willis@outlook.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailandrew.story18@outlook.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emaildavid.babcock96@outlook.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailazlanrahman322@gmail.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailmattpalmer0602@gmail.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailtinystar368@gmail.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailjustin.campos454@outlook.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailgerry.smith2026@outlook.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailwesley.moses97@outlook.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailjoseph.jordan93@outlook.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emaillesstafford24@outlook.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailangelinaparrish18@outlook.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailignacionunez91@outlook.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailmoniquemeza22@outlook.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| emailbradley.steven93@outlook.com | Attacker-controlled throwaway npm publisher email. tinystar368@proton.me and tinystar368@gmail.com share the tinystar368 handle, linking the tinystar8 and weed0 accounts. | 1 | |
| github repotinystar8/mathsbase | Attacker source repo for mathsbase; the loader is in the npm build only, not this GitHub source (commit 560d97e66140dbf817e04284a7a0c58757d1202e). | 1 | |
| github repomathubio/math-universe | Attacker source repo for math-universe; loader in npm build only, not this GitHub source (commit da99dd46501c75ba6102a51ef60ebb922174da32). | 1 | |
| github repoandrewstory18/worker1 | download-inflation worker repo (1 of ~10 under andrewstory18) (reported, not independently verified by SafeDep). Representative sample of a ~30-repo worker farm across 4 accounts. | 1 | |
| github repodavidbabcock96/job_worker1 | download-inflation worker repo (1 of ~10 under davidbabcock96) (reported, not independently verified by SafeDep). Representative sample of a ~30-repo worker farm across 4 accounts. | 1 | |
| github repoazlanrahman322-creator/job-worker1 | download-inflation worker repo (1 of ~10 under azlanrahman322-creator) (reported, not independently verified by SafeDep). Representative sample of a ~30-repo worker farm across 4 accounts. | 1 | |
| github repoUmajiHidekata/jobworker | download-inflation worker repo (reported, not independently verified by SafeDep). Representative sample of a ~30-repo worker farm across 4 accounts. | 1 | |
| file pathlib/cjs/utils/subwatcher | Dropped attacker artifact written and executed by the implant (Slack and blockchain paths). Not a mathjs file, so the strongest on-disk path signature. | 1 | |
| sha256ab66c98e8ed5235feb963ec8845765f62f5f26b1c58c266c409767e53bcb5ccd | Loader file lib/cjs/utils/event.js (SafeDep-confirmed; identical across all 5 versions). | 1 |