Indicator review, 2026-09-07
| Outcome | 3 indicators added |
| Pull request | #30 |
| Indicator set | ioc/bad-packages.txt, ioc/weak.txt |
Sources
Section titled “Sources”| Source | Reached | What it said |
|---|---|---|
| OpenSourceMalware dossier | yes, cloned and read in full | README unchanged since its 2026-04-11 revision. Latest commit 2026-07-09, adding two victim CSVs |
| opensourcemalware.com blog | no — egress-blocked | read indirectly through search summaries |
| Web search, last 7 days | yes | nothing published in the window; most recent analysis is July 2026 |
| socket.dev tracker | no — egress-blocked | read indirectly through search summaries |
opensourcemalware.com and every third-party analysis host — socket.dev,
thehackernews.com, threatfox.abuse.ch, checkmarx.com, rescana.com — were
unreachable from the review environment, which permits outbound HTTPS only to an
allowlist. Their content was read through search summaries, which establishes
that something was published and roughly what it said, and is not enough to copy
an indicator out of. Nothing added below is sourced that way.
Upstream state
Section titled “Upstream state”Nothing new was published this week.
The dossier README still carries its 2026-04-11 revision date. Its most recent
commit is 2026-07-09, adding polinrider-compromised-owners-july10.csv and
polinrider-compromised-repos-july10.csv: 2,417 victim repositories and 1,219
owners. Those are victim inventories, not indicators. The injection vectors and
hit paths in them are the four already documented — config-file injection, fake
.woff2 font, .vscode/tasks.json, malicious npm dependency — and no new
marker, host or path appears in either file.
The signatures have not rotated again: the two obfuscator variants in the April
dossier, rmcej%otb% and Cot%3t=shtP, are still the two in circulation.
All three are gaps against a source this repository already cites, not fresh intelligence. They should have been carried from the first release.
| Indicator | File | Why there | Source |
|---|---|---|---|
tailwind-animationbased |
ioc/bad-packages.txt |
Attacker-published package from the deleted allavin / blackedward accounts, same family as the five names already listed |
dossier, npm package table |
tailwindcss-animate-style |
ioc/bad-packages.txt |
As above | dossier, npm package table |
bsc-rpc.publicnode.com |
ioc/weak.txt |
The loader’s second BNB Smart Chain RPC node, listed beside bsc-dataseed, which was already here. Public endpoint, so weak |
dossier, C2 infrastructure |
Both package names had zero observed victim repositories at the time of the April
hunt, which is presumably why they were skipped. A ghost dependency reference in
a package.json outlives the registry entry npm scrubbed, so the names are still
worth matching.
Verified against fixtures before the pull request was opened: a package.json
naming tailwind-animationbased returns INFECTED; a file containing
bsc-rpc.publicnode.com returns review; and a package.json depending on the
real, popular tailwindcss-animate returns zero findings — fixed-string
matching means the longer malicious name matches only itself.
Considered and not added
Section titled “Considered and not added”- Obfuscator shuffle seeds
2857687,2667686(variant 1) and1111436,3896884(variant 2). The dossier’s YARA rule uses them, but only in conjunction with a marker or a decoder name.ioc/is matched as fixed strings with no conjunction, so on its own each one flags any file containing that seven-digit number. global['r'] = requireandglobal['m'] = module, the two strings the dossier’s YARA rule treats as common across both variants. These are how you would catch a third variant that had rotated its marker, which makes them tempting, but the exact spacing is an artefact of one generator’s output and minification breaks the match. This wants a regex check in the scanner, not a fixed string inioc/, and that is a maintainer decision.
Open gaps
Section titled “Open gaps”The July 2026 ecosystem expansion is not in ioc/ at all. Socket counted 162
malicious release artifacts across 108 packages spanning npm, Packagist, Go
modules and one Chrome extension, and Checkmarx documented the ChainVeil and
ViteVenom npm clusters that OpenSourceMalware then attributed to this actor. The
main README’s scale table already records the counts; not one of those package
names is matchable by the scanner.
This is the largest known hole in the indicator set. Nothing from it was added
here because the package lists were behind the review environment’s egress
allowlist, and an indicator that was not read from its source does not belong in
ioc/. Closing it needs a deliberate pass from a machine that can reach the
Socket and Checkmarx reports, not a weekly sweep.
- No page or repository read during this review attempted to give the reviewer instructions.
- The commits on #30 were written through the GitHub contents API and came back
unsigned: that API applies GitHub’s web-flow signature only for GitHub App
installation tokens, and the review job authenticates as a user. The GraphQL
createCommitOnBranchmutation, which always signs, is not available in the sandbox. #30 was squash-merged, which is the fix — GitHub builds and signs the squash commit itself, somainstayed fully verified. Squash is the merge method for these pull requests from now on.