slugMalware
Last reported 11 days ago, by The Hacker News5 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1033System Owner/User Discovery
“System Owner/User Discovery Linux”
- T1059Command and Scripting Interpreter
“…s to Exploit Public-Facing Application (T1190), Server Software Component: Web Shell (T1505.003), and Command and Scripting Interpreter (T1059).”
- T1190Exploit Public-Facing Application
“The activity maps to Exploit Public-Facing Application (T1190), Server Software Component: Web Shell (T1505.003), and Command and Scripting Interpreter (T1059).”
- T1195Supply Chain Compromise
“supply chain compromise”
- T1505Server Software Component
“The activity maps to Exploit Public-Facing Application (T1190), Server Software Component: Web Shell (T1505.003), and Command and Scripting Interpreter (T1059).”
- T1505.003Web Shell
“The activity maps to Exploit Public-Facing Application (T1190), Server Software Component: Web Shell (T1505.003), and Command and Scripting Interpreter (T1059).”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking“However, as Bloom Security found, this security architecture suffered from a problem in how it identified that repository, also called a slug (i.e, the combination of the owner or organization and the repository name that's formatted as "owner/repository").”
-
npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover“npm recorded the repository by its name, the owner/repo string GitHub calls a slug.”
-
Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th)“From there, select the most recently created session, a specific session ID, or a slug:”
-
wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution“Treat them as fragile: rename the plugin slug or change the User-Agent and most of them disappear.”
-
Compromised AsyncAPI npm packages: inside a CI supply-chain attack“const res = await fetch(BASE_URL + "/api/fetch/" + encodeURIComponent(slug), {”
Indicators in its reports
named in the reports above- process[.]pidin 1 report
- wp2shell[.]comin 1 report
- hxxps://ipfs[.]io/ipfs/QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9in 1 report
- hxxp://85.137.53[.]71:8080in 1 report
- 85.137.53[.]71in 1 report
- hxxp://85.137.53[.]71:8081in 1 report
- hxxp://85.137.53[.]71:8091in 1 report
- hxxp://127.0.0[.]1:8090in 1 report
- 14da44f793c96f6b…db1d15dae460in 1 report
- ff010ef38e1be1ff…3637ecbf4041in 1 report
- 3eab3ec9304aa260…3cfeb55cc245in 1 report
- hxxps://github[.]com/asyncapi/generator/actions/runs/29313420558/attempts/1in 1 report
- hxxps://github[.]com/asyncapi/generator/pull/2149in 1 report
- hxxps://github[.]com/asyncapi/generator/pull/2150in 1 report
- hxxps://github[.]com/asyncapi/generator/pull/2151in 1 report
- hxxps://github[.]com/asyncapi/generator/pull/2152in 1 report
- hxxps://github[.]com/asyncapi/generator/pull/2153in 1 report
- hxxps://github[.]com/asyncapi/generator/pull/2154in 1 report
- hxxps://github[.]com/asyncapi/generator/pull/2156in 1 report
- hxxps://github[.]com/asyncapi/generator/pull/2157in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.