/
vendors:Telegram × latest_source_host:safedep.io × limpar

Resultados

2 casos · pág. 1/1

safedep.io · high

PolinRider loader uses Ethereum transactions as C2 resolver in 35 GitHub repositories, including a pull request to oxc

SafeDep reports that the PolinRider loader family now resolves its C2 servers from Ethereum mainnet. The loader reads small transactions from operator wallets and decodes the recipient address as an IP:port. SafeDep confirmed 35 GitHub repositories carrying the loader at HEAD on 2026-09-30 (7,578 stars and 2,884 forks combined). The inves…

technology software development
safedep.io · high

Npm packages mathmain, mathsbase and math-universe hide a password-triggered encrypted RAT loader in a mathjs copy

SafeDep found a remote access implant in mathmain, an npm package that copies mathjs, and in two sibling packages, mathsbase and math-universe. The malicious code ships AES-256-GCM encrypted and activates only when lusolve() is called with matrix data whose LU lower factor serializes to a specific password. Once decrypted, the implant tak…

software development