I analyse malware aimed at software developers, mostly the North Korean “Contagious Interview” operation that hides implants in fake job interview projects, and write the tools I use to take it apart.
Posts include sample hashes, indicators and the detection rules I tested against them.
-
What the npm registry remembers
Removed npm releases leave a lot behind. Rebuilding the axios, easy-day-js and qix compromises from registry metadata alone, and turning that into a detector.
-
A raw TCP backdoor behind the cleverstack git hook lure
Two files tagged BeaverTail turn out to be a Node.js backdoor that skips HTTP and Socket.IO and talks newline-delimited JSON over plain TCP. Protocol, delivery chain, detections.