@testrelic/playwright-analytics@2.13.0
│
├─ npm executes scripts/postinstall.cjs
│ SHA-256:
│ 19795496ad752f37b76a2dd5d6c6a2914ab6fa62bda0bda7bfe5cd4afd9f029f
│
├─ Hidden code after whitespace is decoded and executed
│ Decoded-loader SHA-256:
│ 0d91fd2c87904ab651a0b5673ecd83a6dc9e8bfcb9bc640b65b39f713c6d8a82
Marius Benthin marius-benthin
marius-benthin
/ iocs.md
Created
August 20, 2026 08:41
Malicious Rust crates proc-macro1 and proc-macro-en: Analysis and IOCs
Two malicious Rust crates—proc-macro1 version 1.0.107 and proc-macro-en version 1.0.10—impersonate the naming, source, authorship, and metadata of the legitimate proc-macro2 ecosystem.
Both contain the same malicious build.rs, byte for byte. Building either crate directly or as a transitive dependency downloads and launches a platform-specific payload. Commands that may trigger execution include cargo build, cargo check, and cargo test.
The build script:
Nextron Research analyzed two malicious VS Code extensions distributed as Trello Board by publisher TrelloWorks and Trello Deck by publisher TrelloSoftWorks. The extensions are Windows-focused, multi-stage loader consistent with the SaassyCode campaign documented by Knostic.
Related research: https://www.knostic.ai/blog/new-vs-code-extensions-attack-campaign-saassycode-managerblx-trelloblox
The extensions activate automatically when VS Code finishes starting. They launch an obfuscated installer from its bundled boardflow dependency in a hidden, detached process. The installer downloads and executes a BAT payload over unencrypted HTTP.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Studio-Co/trelloboardv2 | |
| a157ffec8c799caaca37f5a8ec3ea48891fb5662294f6ed5652dac3b5ab494f1 (v1.5.2) | |
| bcc3e1e60fd6ee7f7b1bc4846904aa66ff0f3cf113333daae894081e82589d53 (v1.5.1) | |
| Microco/trelloboarda | |
| 461ffa8d19e18a01216af0c534401d147c062c56f2857c9e78fccc137d22d61c (1.6.0) | |
| cf92da596a4f0a7193271fee17d15e60182d49babb7710750a6da2d7ed04c114 (1.5.8) | |
| dfdb4b286f172092e7e91ee5335b2fa5d683e80adc54e9300450a4da147c7cc0 (1.5.7) | |
| b42e669627a349fa3a3536a0ad1fee92601f18a2a179f8bfd577173cfce5f938 (1.5.6) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| @arv-bedrock/auth@1.1.7 | |
| @arv-bedrock/auth-admin@1.0.2 | |
| @arv-bedrock/auth-sso@1.6.1 | |
| @arv-bedrock/auth-sso-backend@1.7.1 | |
| @arv-bedrock/logger@1.7.1 | |
| babel-plugin-linaria-css-to-undefined@0.3.17 | |
| babel-plugin-linaria-css-to-undefined@0.3.5 | |
| babel-plugin-linaria-css-to-undefined@0.3.8 | |
| conv-context-next@1.0.10 | |
| conv-context-next@1.0.6 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Packages: | |
| n8n-nodes-devops-utils | |
| n8n-nodes-task-runner | |
| n8n-nodes-utils-helper | |
| n8n-nodes-net-utils | |
| n8n-nodes-port-scanner | |
| n8n-nodes-api-finder | |
| n8n-nodes-probe | |
| n8n-nodes-http-probe | |
| n8n-nodes-quick-utils |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Payload: | |
| lib/.threadpool.rb | |
| - eb6948d5105e662f8b9383824b15f13f01d33b1730b57683a5676d252effad5e | |
| - 5b76c947d9ce42444c2b65d68c11ce97d04b29b7e7cbb16345cc69dfde763731 | |
| RubyGems: | |
| - giga-clean-rb@0.1784231774 | |
| - hyper-max-rb@0.1784231874 | |
| - mega-lite-box@0.1784231793 | |
| - micro-pro-box@0.1784231854 |
marius-benthin
/ gist:daa77a4c25e1bbfe5614cd89b75c9209
Created
July 14, 2026 14:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Packages: | |
| - solana-key-utils@1.0.2 | |
| - crypto-validate-lib@1.0.2 | |
| - eth-wallet-helpers@1.0.2 | |
| Payloads: | |
| keypairs.dat (AES-256-CBC encrypted) | |
| - 5f8c9e167ae937005647d54c12a2dc083fedb9f166792e1d7ae87b7166d58997 | |
| - 89893e61ef57050cb1129bcfc4c9d233d19ce9e6d1da06036ec9256c752a4863 | |
| - cb9629eb3590b51c7ac108f7de3e4f62bbea0681bf46b4a9ef68be82b9be0794 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| https://jsonkeeper.com/b/QWPQX -> c96ddbdab5bbe445d8f3604daca62b80541ece02cc874c338146965e4820a595 | |
| http://5.175.184.52/api/service/ca6f8e4ee9a04abf7d68a49b30173f93 | |
| - webpack-patch@1.2.0 | |
| - nodepack-daemon@1.2.9 | |
| https://www.jsonkeeper.com/b/J7GQS -> 5378db7736667dd571b2805d72ef64395b3827a9aa5a7e8d7d16394560a35ac9 | |
| https://www.jsonkeeper.com/b/FNOBS -> 32432350af338723c863383946897fa079dce3a96bd8a5e89fa2b7af4fa4a6c5 | |
| https://www.jsonkeeper.com/b/JTOGJ -> 3ac6e6975182202a6ff3cad52419e68d5ecfaf8c9a7bbd6b4e62f8a17c5b24f3 | |
| http://104.243.41.127/api/service/be589bdd68d5eba594850c281cbfe945 | |
| - vite-config-field@1.1.5 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| github.com/MooooonStar/red-or-black v0.0.0-20191225051109-9fe850cfd716 | |
| github.com/artiffusion-inc/mirofish v0.0.0-20260607125909-8eef83be9e2f | |
| github.com/xpos587/markfetch v0.0.0-20251010125116-b4dcc50827e2 | |
| github.com/tsenst/rloflib / v0.0.0-20190106205216-ced640e0919d | |
| github.com/lambda-platform/lambda v0.9.20-0.20260619012358-12b5a6e0c244 | |
| github.com/reauheau/goaubio v0.0.0-20260213144826-0c7c4a5b5859 | |
| github.com/glacialspring/go-winsparkle v0.0.0-20250402002608-ba5501b8ba90 | |
| github.com/bm-197/chill v0.0.0-20241216030053-8573b6044fba | |
| github.com/naol7/dist-task-scheduler v0.0.0-20241120175214-0365b36af82f | |
| github.com/anatoli-derese/a2sv-excercise v0.0.0-20240805074755-5adbbc600635 |
NewerOlder