Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| domainjs-mirror.com | Previously active C2 domain (external reporting). Impersonates JavaScript CDN mirror. Rotated out via on-chain contract update. | 1 | |
| domainpypi-get.com | Previously active C2 domain (external reporting). Impersonates PyPI package mirror. Rotated out via on-chain contract update. | 1 | |
| sha256adc4af90540d33cd1e98f44b51482ae9250fbeb97d6f8d7841c81b618cb2c6e6 | npm tarball hash for @joyfill/layouts@0.1.2-2773.beta.0 (PolinRider blockchain C2 loader) | 0 | |
| sha256bcc93dc55bc7daedf4ca57254f0e7a7f1c40e09851eab98fe10cde801982db17 | npm tarball hash for @joyfill/components@4.0.0-rc24-2773-beta.4 (dependency chain to PolinRider layouts) | 0 | |
| walletTMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP | Primary Tron C2 address for PolinRider campaign. Stores encrypted C2 URL in smart contract data. Shared across @joyfill/layouts and astro.config.mjs attacks. | 1 | |
| walletTXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG | Fallback Tron C2 address for PolinRider campaign. Used when primary address TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP is unavailable. | 1 | |
| wallet0x9bc1355344b54dedf3e44296916ed15653844509 | BSC (Binance Smart Chain) attacker wallet for PolinRider campaign. Transaction data from this wallet carries XOR-encrypted JavaScript payload. | 1 | |
| walletTA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v | Stage 2 Tron C2 address for PolinRider campaign. Second blockchain fetch uses this address after campaign routing selects HTTP C2 server. | 1 | |
| ipv4166.88.134.62 | PolinRider HTTP C2 for 'A' campaign markers (@joyfill). Branch B (0xa322) C2 2026-07-25 to 2026-08-22 (/0x/cls, /0x/ls on :443). AS149440 Evoxt. | 1 | |
| ipv4198.105.127.210 | PolinRider HTTP C2 for numeric campaign markers (astro.config.mjs, @joyfill). Branch A (0x33ff) C2 #1 from 2026-09-25: plain HTTP on :443 serving /boot and /init. AS149440 Evoxt. | 1 | |
| ipv423.27.202.27 | HTTP C2 server for PolinRider campaign (default fallback, port 27017). Set by stage 2 campaign routing. | 0 | |
| urlhttps://metrics.femboy.energy/v1/collect | Import-time credential-stealer C2 / exfil endpoint (HTTP POST). Statically decoded from a base64-then-XOR (key 'tf_compat_v2') constant at mrmustard/__init__.py:33. Attacker-controlled; do not contact. | 0 | |
| domainmetrics.femboy.energy | C2 / exfil host for the mrmustard 0.7.4 credential stealer. | 0 | |
| urlhttps://webhook.site/710babde-6ace-47fe-83f4-9688e6548df9 | Dead-drop for CI secrets (PIPY_TOKEN, CODECOV_TOKEN) exfiltrated by the poisoned GitHub Actions workflow ci-mrmustard-check.yml at commit 80aba72. webhook.site is a legitimate request-inspection service abused as a dead drop; the unique token path is the indicator. | 0 | |
| file path~/.cache/.tf_cache/hw_probe.pyc | Compiled-only (source-less) persistent copy of the stealer. Sibling artifacts in ~/.cache/.tf_cache: .lock_<machineid> guard and .ts_<machineid> timestamp files. | 0 | |
| file pathmmcompat.pth | Persistence launcher dropped into the first writable site-packages dir; runs hw_probe.pyc on every Python interpreter startup. | 0 | |
| sha25681f0d1291a975d012d1b892cf9967557fdbb1ad4e1ac0545702ad235ace1cac5 | SHA256 of mrmustard-0.7.4-py3-none-any.whl. sdist SHA256 (0404f8...) is recorded on the package version. | 0 | |
| domainoob.sl4x0.xyz | Campaign DNS-exfiltration endpoint. Loader encodes username/hostname/cwd/timestamp plus a per-package tag as subdomain labels and resolves them via dns.resolve4(). Shared across all sl4x0 packages and ecosystems (reused, not new infrastructure, in this untargeted uploader-frontend wave). | 1 | |
| emailgoldmanachspoc@sl4x0.xyz | New npm publisher account for the Goldman Sachs wave. Follows the campaign's <targetco>poc@sl4x0.xyz naming convention. | 1 | |
| emailresearch@sl4x0.xyz | Author identity ('Enterprise Tools Team <research@sl4x0.xyz>') on the uploader-frontend npm packages. Now confirmed across THREE clusters in this campaign: Anduril-targeting PyPI packages, the Goldman Sachs gs-uitk-* npm wave, and this untargeted uploader-frontend npm pair. The third confirmed literal-identity reuse strengthens the high-confidence single-actor overlap across ecosystems and target types (defense, finance, and untargeted). | 1 | |
| file pathlib/6ad264.js | Hex-array-obfuscated loader shipped by both gs-uitk packages (byte-identical between them). Reaches require('os')/require('dns') via module.constructor._load() plus String.fromCharCode indirection to evade static require() scanning. | 1 | |
| file pathlib/b02e30.js | Per-package config file; hex-decodes to the exfil domain oob.sl4x0.xyz plus a per-package DNS tag (goldman1 for gs-uitk-object-utils, goldman2 for gs-uitk-testing-utils) used to correlate DNS beacons back to a specific package. | 1 | |
| emaildialoguepoc@sl4x0.xyz | NEW npm publisher account for the untargeted uploader-frontend / uploader-frontend-legacy wave (2026-07-20). Follows the campaign's *poc@sl4x0.xyz account convention but without a target-organization prefix, consistent with an untargeted/generic publish rather than a named-target wave. | 1 | |
| file pathlib/core.js | Hex-obfuscated harvesting core loaded by index.js (require('./lib/core') in try/catch). Reads os.userInfo().username, os.hostname(), basename(process.cwd()), sanitizes each via clean(), then dns.resolve4()s <tag>.<user>.<host>.<cwd>.<unix-ts>.oob.sl4x0.xyz. Adds setTimeout(()=>{},500).unref() after the DNS call (refinement not seen in earlier oc-aa-module-client/gs-uitk samples). | 1 | |
| sha256ce42880a5be86ce5b7db2e4ce47b04b233308f6e0c0ffff9c9da7a8b39ca5a3f | SHA256 of index.js in uploader-frontend@9.9.11 (install entrypoint; require('./lib/core') in try/catch, exports version 9.9.11). | 1 | |
| sha256397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4 | SHA256 of lib/core.js in uploader-frontend@9.9.11 (hex-obfuscated harvesting core + dns.resolve4() beacon with setTimeout unref refinement). | 1 | |
| sha2567e5dffc0070dfd23371f2f41227b1e3b0f81b85bfaf4fe87e35c5c64e5ddd748 | SHA256 of lib/b02e30.js in uploader-frontend@9.9.11 (per-package config; hex-decodes to oob.sl4x0.xyz + DNS tag 'uploadfe'). uploader-frontend-legacy's copy differs (tag 'uploadfele') and therefore has a different, unprovided hash. | 1 | |
| sha25695ed14077ba3da5517e8b1816a38f3961cebd6f6fb84c86b1bd77ab0a4dcdff4 | SHA256 of lib/6ad264.js in uploader-frontend@9.9.11 (utility wrapper { os, dns, proc: global.process, clean }). | 1 | |
| sha2560247cc50a0a57a241e6eda6714516e5864f23389977049c30052cfb3a69abd2f | SHA256 of package.json in uploader-frontend@9.9.11 (scripts.install 'node index.js'; author 'Enterprise Tools Team <research@sl4x0.xyz>'; fabricated repo github.com/slaxorg/nms-dashboard-js). | 1 | |
| domainupdate.apex-arena-router.com | Primary C2 / exfil host. Resolves to 172.93.185.150 (xTom GmbH, AS3214, Frankfurt). Caddy reverse proxy in front of Uvicorn/FastAPI, wildcard Let's Encrypt cert for *.apex-arena-router.com, /openapi.json exposed unauthenticated. Serves loader.sh + payload.enc, receives exfil uploads, and answers the 60s persistence ping. | 1 | |
| domainapex-arena-router.com | C2 base domain / wildcard cert *.apex-arena-router.com. Multi-tenant panel provisions per-campaign subdomains under this apex. | 0 | |
| domainapexfdn.xyz | Operator brand domain ('Apex Foundation'). Anchors the npm scope @apexfdn and maintainer emails. | 1 | |
| domainarena.apexfdn.xyz | Operator front/dashboard host (arena.apexfdn.xyz/dashboard/copilot). Hosts the remote-MCP endpoint and receives the @apexfdn/copilot-mcp front package's forwarded tokens and document excerpts. | 1 | |
| domaindocs.apexfdn.xyz | Operator documentation host in the apexfdn.xyz family. | 1 | |
| urlhttps://arena.apexfdn.xyz/api/copilot/mcp | Hosted remote-MCP endpoint reached with a Bearer token. No-install infection vector that sends tokens to attacker infrastructure without any package install. | 1 | |
| urlhttps://update.apex-arena-router.com/payload.enc | AES-256-CBC encrypted macOS stealer payload fetched by loader.sh, decrypted in memory (key = upload token) and piped to osascript. Never written to disk as a separate file. | 1 | |
| ipv4172.93.185.150 | C2 server IP. xTom GmbH (AS3214), Frankfurt am Main, Germany. | 1 | |
| sha256ecd1113fae1ede9869afd9d1af612bab7f1a2054e5c45a346e18c107c22b9164 | payload.enc, the AES-256-CBC encrypted 707-line AMOS-family AppleScript stealer. Decrypts with the upload token 5c6f24c905ae3883355a26fceac3dda0d0dfe67ba8e1220ebe784a29544c6ee4 (SHA-256 key derivation); that same value doubles as the X-Upload-Token in every exfil request. | 1 | |
| sha1233f90180b529aa32911901e5222e9ed9c3cd24c | npm tarball SHA1 for @copilot-mcp/apex@1.0.0 (inline curl|zsh launcher variant). | 1 | |
| sha13b9a880ae4e1c5b7bbd68e118a1c3c8b592f7bfb | npm tarball SHA1 for @copilot-mcp/apex@1.0.19 (compiled apex-helper-darwin launcher variant). | 1 | |
| emailchefkecharlie@gmail.com | Operator-associated email (ties to Telegram @charlereum). | 1 | |
| emailarena@apexfdn.xyz | npm maintainer email for the dropper (@copilot-mcp/apex / @apexfdn/apex). | 1 | |
| emailcontact@apexfdn.xyz | npm maintainer email for the front package @apexfdn/copilot-mcp. Same apexfdn.xyz domain as the dropper maintainer, linking the two scopes to one operator. | 1 | |
| file path/tmp/osalogging.zip | Staged stolen-data archive (ditto -c -k) uploaded over chunked HTTPS PUT, then rm -f'd for anti-forensics. | 1 | |
| file path/tmp/sync<random>/ | Stealer staging directory where browser data, wallets, keys, and Keychain are collected before archiving; cleared after upload. | 1 | |
| file path~/Library/LaunchAgents/com.system.notifications.agent.plist | Persistence LaunchAgent (label com.system.notifications.agent, StartInterval 60s) that polls /v1/agent/ping on the C2 host every 60 seconds for follow-on commands. | 1 | |
| file path~/Library/Application Support/System/System Notifications.app | Fake app bundle (bundle ID com.system.notifications.helper.bld013) dropped and registered via lsregister; masquerades as macOS 'System Notifications'. | 1 | |
| github repoApex-Foundation/copilot | Weaponized fork of can1357/oh-my-pi that hosts the downloaded release binaries (apex-linux-x64, apex-darwin-arm64/x64, apex-windows-x64, apex-helper-darwin, apex-auth-darwin, pi_natives.win32-x64-baseline.node). install.cjs fetches from its v1.0.0 release tag; assets are swappable server-side. Still live after both npm takedowns. | 1 | |
| github repoApex-Foundation/copilot-mcp | The advertised (clean) source in the dropper's repository field; benign TypeScript that misdirects reviewers away from the real binary source Apex-Foundation/copilot. | 1 | |
| domaingit.disroot.org | Legitimate public Forgejo instance. NOT attacker-owned; the attacker registered the username/namespace 'git-ecosystem' on it to look legitimate and host payload binaries. Only the git-ecosystem namespace is malicious. Treat the bare domain as a qualified indicator. | 0 |