@capibar.chat/ui-kit
Dependency-confusion impersonation in the @capibar.chat scope, published by t-in-one. Version 99.5.7 weaponized on 2026-05-29; scope pre-staged with benign-versioned 99.0.7 on 2026-05-04. Same C2 and X-Secret as the rest of the campaign.
discovered 2026-05-29
Threat types
dependency_confusioncredential_stealerdata_exfiltrationc2_agent
Malicious versions
- 99.0.7
- 99.5.7
