executions[.]dataDomain
Reported by 1 independent source · first reported by Zscaler ThreatLabz · last reported
Last reported 10 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Shai-Hulud V2 Poses Risk To NPM Supply Chain“…/or git history.Cloud credentials in unexpected locations.The TruffleHog binary is cached in ~/.truffler-cache/ for subsequent executions[.]Data exfiltration via GitHubIn Shai-Hulud V2, stolen data is exfiltrated to GitHub repositories that are created using compromised tokens…”
Indicators reported together
named in the same reports- detected[.]inin 1 report
- environment[.]ciin 1 report
- history[.]cloudin 1 report
- hxxps://raw.githubusercontent[.]com/$in 1 report
- repo[.]namein 1 report
- hxxps://github[.]com/actions/runner/releases/download/v2.330.0/actions-runner-linux-x64-2.330.0.tar.gzin 1 report
- hxxps://github[.]com/$in 1 report
- below[.]namein 1 report
- data[.]azurein 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.