Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| sha2565d9e952c51875d2b897eedc22b002b94ab21c8004d513bc99ce3a885f8a01dae | Loader file lib/cjs/utils/is.js (SafeDep-confirmed; identical across all 5 versions). | 1 | |
| sha256ed9b078594393d09d91ee008366ca75e3017cca18c79af99c5b294c61db67f06 | Encrypted payload lib/cjs/utils/graph.js, Deployment A (SafeDep-confirmed). | 1 | |
| sha25609773ee7db70216b778b15cfcd94cb1df8963eddd4a47b801c96f986651699e6 | Encrypted payload lib/cjs/utils/fraction.js, Deployment A (SafeDep-confirmed). | 1 | |
| sha256ca4fe552da461fec5b51d5964d979699f06888499be442f209125853dff3e0e1 | Encrypted payload lib/cjs/utils/bignumber/type.js, Deployment A (SafeDep-confirmed). | 1 | |
| sha2560aa46d32e4b479cc09f97cc66a1f12ca96b0497a7eb6ffc6b46ed3ef80e3c83b | Encrypted payload lib/cjs/utils/graph.js, Deployment B (SafeDep-confirmed; mathsbase@1.0.1). | 1 | |
| sha2561e0f09c84aaf573627c003ce0f086517c3ea980cbea02f8ff918b1cc0d7e0bbb | Decrypted payload lib/cjs/utils/graph.js, Deployment A (SafeDep-confirmed; on-disk after loader runs). | 1 | |
| sha2566fd655d7196880fc5783f9dbb62b428baf220c2781970be54044376330be7af3 | Decrypted payload lib/cjs/utils/fraction.js, Deployment A (SafeDep-confirmed; Slack agent). | 1 | |
| sha2566b1ad71bc3765dd272ea2ac63c1ea6ed97091ba0067d0b3e2294e1b34177cb25 | Decrypted payload lib/cjs/utils/bignumber/type.js, Deployment A (SafeDep-confirmed; bundled ethers 5.7.2). | 1 | |
| md591e020c13cb97a6365135b53b0d0fe5f | WASM download-inflation decoder (reported, not independently verified by SafeDep; hardcoded key npm_workvr_protect_key_v1). | 1 | |
| file pathevil.rb | Attacker payload script filename used across the GemStuffer / 'OpenAI Swarm' campaign, loaded via a gem's .yardopts '--load' directive to achieve RCE during a RubyDoc.info documentation build. Confirmed exact reference in yardxabc889@0.0.1: '--load ./evil.rb'. | 1 | |
| file pathhack.rb | Attacker payload script filename observed across the GemStuffer / 'OpenAI Swarm' campaign, loaded via a gem's .yardopts '--load' directive to achieve RCE during a RubyDoc.info documentation build. | 1 | |
| file pathssrf.rb | Attacker payload script filename observed across the GemStuffer / 'OpenAI Swarm' campaign, loaded via a gem's .yardopts '--load' directive to achieve RCE during a RubyDoc.info documentation build. | 1 | |
| file pathinject.rb | Attacker payload script filename observed across the GemStuffer / 'OpenAI Swarm' campaign, loaded via a gem's .yardopts '--load' directive to achieve RCE during a RubyDoc.info documentation build. | 1 | |
| file pathexploit.rb | Attacker payload script filename observed across the GemStuffer / 'OpenAI Swarm' campaign, loaded via a gem's .yardopts '--load' directive to achieve RCE during a RubyDoc.info documentation build. | 1 | |
| github repoadmin-dashboards/react-dashboards | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repoapp-generator/django-admin-berry | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repoIsaac-1-lang/GreenIQ | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repoIsaac-1-lang/Wastewise | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repoIsaac-1-lang/Real_time_chatting | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repobooali9/helvita | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repoMinhal128/Apaxe-client | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repoMinhal128/CodeX | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repomu-majid/Node.JS-Self-Study-Projects | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repomu-majid/LLM-engineering-projects | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repoNEBOLISA/techCare | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repoMMAHAD911313/algoritmi-ata-be | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repoHyderYash/simple_crud_app | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repomuhammad-tahir-sultan/thedonotp | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repochidubemokeke/Social-App_The-Graph_NextJS | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repoalokkumar006/TeleGuide | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. User-supplied link; no commit timestamp recorded. | 1 | |
| github repoIdenbrid1/BizblancaVueProject | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-16T13:34:38Z. | 1 | |
| github repojazzisavi/Cycleaware | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-13T03:30:47Z. | 1 | |
| github repoAfzal-Iqbal/portfolio | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-12T18:20:11Z. Afzal-Iqbal pair (portfolio + nest-Aouth) committed ~5s apart — single-actor spray, not independent infection. | 1 | |
| github repoAfzal-Iqbal/nest-Aouth | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-12T18:20:06Z. Afzal-Iqbal pair (portfolio + nest-Aouth) committed ~5s apart — single-actor spray, not independent infection. | 1 | |
| github repoTanvir-Alam625/express-route-lens | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-16T12:02:14Z. Part of the Tanvir-Alam625 single-actor spray: 10 repos sprayed with the same tasks.json payload in tight time windows. | 1 | |
| github repoTanvir-Alam625/Image-Sorting-App | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-16T12:02:14Z. Part of the Tanvir-Alam625 single-actor spray: 10 repos sprayed with the same tasks.json payload in tight time windows. | 1 | |
| github repoTanvir-Alam625/stone-ware-house-management | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-12T18:11:35Z. Part of the Tanvir-Alam625 single-actor spray: 10 repos sprayed with the same tasks.json payload in tight time windows. | 1 | |
| github repoTanvir-Alam625/search-players | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-12T18:11:18Z. Part of the Tanvir-Alam625 single-actor spray: 10 repos sprayed with the same tasks.json payload in tight time windows. | 1 | |
| github repoTanvir-Alam625/Red-Onion-client | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-12T18:11:08Z. Part of the Tanvir-Alam625 single-actor spray: 10 repos sprayed with the same tasks.json payload in tight time windows. | 1 | |
| github repoTanvir-Alam625/public-repo | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-12T18:11:00Z. Part of the Tanvir-Alam625 single-actor spray: 10 repos sprayed with the same tasks.json payload in tight time windows. | 1 | |
| github repoTanvir-Alam625/PC-HUT | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-12T18:10:55Z. Part of the Tanvir-Alam625 single-actor spray: 10 repos sprayed with the same tasks.json payload in tight time windows. | 1 | |
| github repoTanvir-Alam625/Online-Bank-Of-BD-client | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-12T18:10:41Z. Part of the Tanvir-Alam625 single-actor spray: 10 repos sprayed with the same tasks.json payload in tight time windows. | 1 | |
| github repoTanvir-Alam625/kopa-samsu-practise | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-12T18:09:25Z. Part of the Tanvir-Alam625 single-actor spray: 10 repos sprayed with the same tasks.json payload in tight time windows. | 1 | |
| github repoTanvir-Alam625/cicd-assment | PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-12T18:09:00Z. Part of the Tanvir-Alam625 single-actor spray: 10 repos sprayed with the same tasks.json payload in tight time windows. | 1 | |
| sha25654dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668 | setup.mjs Variant A (29,918 bytes, jaredwray npm tarballs only) | 1 | |
| sha2569fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc | Math_Symbol.js / math_init.js stage-two payload (727,680 bytes, byte-identical across both variants) | 1 | |
| sha256fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb | setup.mjs Variant B (11,017 bytes, all non-jaredwray orgs + jaredwray repo IDE hooks) | 0 | |
| wallet0xE1f2395ee43e45A1556EC6438a88c31B83493103 | Ethereum mainnet smart contract storing C2 domain configuration (EtherHiding). 5,196 bytes deployed code. Function selector 0x53ed5143 for domain retrieval. Owner wallet: 0x55f9780e1492344b7417fa723aedc4d0b97f31cd. | 1 | |
| wallet0x55f9780e1492344b7417fa723aedc4d0b97f31cd | Ethereum wallet that deployed and owns the EtherHiding C2 smart contract 0xE1f2395...3103. Controls domain rotation via on-chain transactions. | 0 | |
| domainnpm-cache.com | Active C2 domain retrieved from Ethereum smart contract state (slot at keccak256(1)). Impersonates npm cache infrastructure. Used for encrypted exfiltration via DomainSender (RSA-OAEP + AES-GCM). | 1 |