T1078

Valid Accounts

Uses stolen GitHub credentials of the compromised owner (ocrybit) and the asteroiddao npm account to publish packages and poison repos.

discovered 2026-06-03
View on MITRE ATT&CK ↗

Seen in packages

Campaigns