npm-cache[.]comDomain
Reported by 3 independent sources · first reported by Datadog Security Labs · last reported
Last reported 2 months ago
What the reports say
3 reports, newest first · the exact sentence from each-
Tracking Shai-Hulud: Inside the ChainDrop NPM Worm“hxxps://npm-cache[.]com:443/router”
-
Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages“At the time of our detonation runs, we observed the following dead-drop domains (awqhnjewqjkl.icu, npm-cache[.]com).”
-
'ChainDrop' worm compromises hundreds of popular npm packages“hxxps://npm-cache[.]com:443/router”
Indicators reported together
named in the same reports- awqhnjewqjkl[.]icuin 3 reports
- hxxps://npm-cache[.]com/routerin 2 reports
- 9fc2570b7cef51c1…fc2509cf1bccin 2 reports
- fd3ca4007b225fdf…806e5684b1ebin 2 reports
- f92ee93a0af971a3966bfa8efa9c2625in 1 report
- 7bcf8d9f6834c44450eac145a967d2f2in 1 report
- 4140f7e17e6f97f83aa3472473e01addin 1 report
- logs-endpoint.events[.]networkin 1 report
- go.getblock[.]ioin 1 report
- eth-mainnet.nodereal[.]ioin 1 report
- 54dc7ea54a1317cc…93012b350668in 1 report
- hxxps://github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/in 1 report
- d446803f4c3bc116…d3f95b2825dein 1 report
- 927387d0cfac1118…ba1efc026e1fin 1 report
- 14eb4ce01dd43077…c1aac325b128in 1 report
- 3f3f42d072bd3686…ec0ea572eea7in 1 report
- 29ac906c8bd801df…278c24e4f1a7in 1 report
- 619c56acf572df75…2da3a44f10b4in 1 report
- dc1e6a7ddb29390d…b7a796808b67in 1 report
- 166be2b7b58a440f…7eb04b9ada65in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.