This file is a sophisticated trojanized VS Code extension impersonating the legitimate juanblanco.solidity Solidity extension. The publisher name juunfranbIanco contains deliberate typosquatting variations ("juun" vs "juan", capital "I" vs "l") to deceive victims. Beyond providing real Solidity language support as cover, it deploys a cross-platform remote access trojan (RAT) named evjawbreaker that uses the Ethereum blockchain for command-and-control (C2).
Marius Benthin marius-benthin
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| rule MacOS_MachO { | |
| condition: | |
| uint32(0) == 0xfeedface // 32-bit, little-endian | |
| or uint32(0) == 0xfeedfacf // 64-bit, little-endian | |
| or uint32be(0) == 0xfeedface // 32-bit, big-endian | |
| or uint32be(0) == 0xfeedfacf // 64-bit, big-endian | |
| } | |
| rule MacOS_FAT { | |
| condition: |
marius-benthin
/ runeai-analysis.md
Created
April 30, 2026 10:38
RuneAI Analysis of juunfranblanco.solidity/0.0.189
marius-benthin
/ gist:fdbd00fbf169f749255a2e0a63949a76
Last active
June 4, 2026 06:48
Compromized NPM Packages
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| autotel-mcp@29.0.1 | |
| awaitly-visualizer@22.0.2 | |
| autotel-subscribers@31.1.4 | |
| awaitly-libsql@22.0.1 | |
| awaitly-postgres@23.0.1 | |
| awaitly-mongo@23.0.1 | |
| autotel-hono@0.4.26 | |
| autotel-vitest@0.4.26 | |
| autotel-sentry@0.5.13 | |
| autotel-audit@0.1.15 |
marius-benthin
/ gist:3c669a59ddbd91987933e8d00c940ea8
Created
June 8, 2026 06:55
Compromized PyPI Packages
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| mflux-streamlit@0.0.3 | |
| nhmpy@2.4.7 | |
| rsquests@2.34.3 | |
| rlask@3.1.7 | |
| rlask@3.1.6 | |
| rlask@3.1.5 | |
| rlask@3.1.4 | |
| spateo-release@1.1.2 | |
| dynamo-release@1.5.4 | |
| mrbios@0.1.2 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| github.com/MooooonStar/red-or-black v0.0.0-20191225051109-9fe850cfd716 | |
| github.com/artiffusion-inc/mirofish v0.0.0-20260607125909-8eef83be9e2f | |
| github.com/xpos587/markfetch v0.0.0-20251010125116-b4dcc50827e2 | |
| github.com/tsenst/rloflib / v0.0.0-20190106205216-ced640e0919d | |
| github.com/lambda-platform/lambda v0.9.20-0.20260619012358-12b5a6e0c244 | |
| github.com/reauheau/goaubio v0.0.0-20260213144826-0c7c4a5b5859 | |
| github.com/glacialspring/go-winsparkle v0.0.0-20250402002608-ba5501b8ba90 | |
| github.com/bm-197/chill v0.0.0-20241216030053-8573b6044fba | |
| github.com/naol7/dist-task-scheduler v0.0.0-20241120175214-0365b36af82f | |
| github.com/anatoli-derese/a2sv-excercise v0.0.0-20240805074755-5adbbc600635 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| https://jsonkeeper.com/b/QWPQX -> c96ddbdab5bbe445d8f3604daca62b80541ece02cc874c338146965e4820a595 | |
| http://5.175.184.52/api/service/ca6f8e4ee9a04abf7d68a49b30173f93 | |
| - webpack-patch@1.2.0 | |
| - nodepack-daemon@1.2.9 | |
| https://www.jsonkeeper.com/b/J7GQS -> 5378db7736667dd571b2805d72ef64395b3827a9aa5a7e8d7d16394560a35ac9 | |
| https://www.jsonkeeper.com/b/FNOBS -> 32432350af338723c863383946897fa079dce3a96bd8a5e89fa2b7af4fa4a6c5 | |
| https://www.jsonkeeper.com/b/JTOGJ -> 3ac6e6975182202a6ff3cad52419e68d5ecfaf8c9a7bbd6b4e62f8a17c5b24f3 | |
| http://104.243.41.127/api/service/be589bdd68d5eba594850c281cbfe945 | |
| - vite-config-field@1.1.5 |
marius-benthin
/ gist:daa77a4c25e1bbfe5614cd89b75c9209
Created
July 14, 2026 14:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Packages: | |
| - solana-key-utils@1.0.2 | |
| - crypto-validate-lib@1.0.2 | |
| - eth-wallet-helpers@1.0.2 | |
| Payloads: | |
| keypairs.dat (AES-256-CBC encrypted) | |
| - 5f8c9e167ae937005647d54c12a2dc083fedb9f166792e1d7ae87b7166d58997 | |
| - 89893e61ef57050cb1129bcfc4c9d233d19ce9e6d1da06036ec9256c752a4863 | |
| - cb9629eb3590b51c7ac108f7de3e4f62bbea0681bf46b4a9ef68be82b9be0794 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Payload: | |
| lib/.threadpool.rb | |
| - eb6948d5105e662f8b9383824b15f13f01d33b1730b57683a5676d252effad5e | |
| - 5b76c947d9ce42444c2b65d68c11ce97d04b29b7e7cbb16345cc69dfde763731 | |
| RubyGems: | |
| - giga-clean-rb@0.1784231774 | |
| - hyper-max-rb@0.1784231874 | |
| - mega-lite-box@0.1784231793 | |
| - micro-pro-box@0.1784231854 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Packages: | |
| n8n-nodes-devops-utils | |
| n8n-nodes-task-runner | |
| n8n-nodes-utils-helper | |
| n8n-nodes-net-utils | |
| n8n-nodes-port-scanner | |
| n8n-nodes-api-finder | |
| n8n-nodes-probe | |
| n8n-nodes-http-probe | |
| n8n-nodes-quick-utils |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| @arv-bedrock/auth@1.1.7 | |
| @arv-bedrock/auth-admin@1.0.2 | |
| @arv-bedrock/auth-sso@1.6.1 | |
| @arv-bedrock/auth-sso-backend@1.7.1 | |
| @arv-bedrock/logger@1.7.1 | |
| babel-plugin-linaria-css-to-undefined@0.3.17 | |
| babel-plugin-linaria-css-to-undefined@0.3.5 | |
| babel-plugin-linaria-css-to-undefined@0.3.8 | |
| conv-context-next@1.0.10 | |
| conv-context-next@1.0.6 |
OlderNewer