-= Per source details. Do not edit below this line.=-
Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information
{ "iocs": { "urls": [ "https://pastebin.com/raw/TwHdexDC", "https://canary.discord.com/api/webhooks/1153431050517762059/MAkfrB4n1Gz6qe7W8ffWTZF92yfN3D_FWPFFaK_FBgDQWB1ZYfbKHa61X_8L6GK175r0", "https://canary.discord.com/api/webhooks/1155235432406196334/3eFtMXnG2laJjInzO_kAzLbW6ebMgbrrwmAcRtZyOfqnyCh-twTT9pSumcKr5QJvbGEZ", "https://canary.discord.com/api/webhooks/1152716297474424913/z6-hvrQNeyL0m1Mm34JLYj1VVB67sVEXogqJzGCkxYgMFCgCWhQaR07ruMBck1dJAi9g", "https://canary.discord.com/api/webhooks/1152648911371120681/JlL5FnwmY6nP6RaZxmQ7NI9MGR6HARmAekaPqPDdVTq9K3RJ68Lcd7cz16l9u6eZH9c3", "https://discord.com/api/webhooks/1103033150558457876/22oUF1rkDTdxz-iq-2EOR4aVXwDr5vFIeE9zWlitIbYSG2E3XhF8KQIzuo1uXy_bOcos", "http://51.178.25.148:8081/upload", "http://51.178.25.148:8081/dl/runtime", "http://51.178.25.148:8081/uploader", "http://51.178.25.148:8081/gethw", "http://51.178.25.148:8081/dl/system", "http://51.178.25.148:8081/getip", "http://51.178.25.148:8081/dl/uwu", "http://51.178.25.148:8081/rooter", "http://51.178.25.148:8081/dl/sys86", "http://51.178.25.148:8081/dl/gamesdk" ], "ips": [ "51.178.25.148" ] }, "malicious-packages-origins": [ { "modified_time": "2023-10-15T10:12:58Z", "import_time": "2023-11-22T12:35:48.820511234Z", "ranges": [ { "events": [ { "introduced": "0" } ], "type": "ECOSYSTEM" } ], "source": "checkmarx", "sha256": "92031dd23356e3a0c484288f4488d15166db6251a4872ec009c6222eafce041d" } ] }