FAFO with security on and off chain.
Joined October 2022
- Tweets539
- Following1.3K
- Followers239
- Likes8.3K
Pinned Tweet
1/12 🔴 jsonspack — 27 DPRK npm packages disguised as chai.js plugins. 0/94 VirusTotal engines caught them. They fire silently on require() — not install — so postinstall scanners see nothing. 3,739 downloads. 12 still live right now.
panther.com/blog/jsonspack-m… 🧵
audityourcontracts retweeted
Year 2035:
"Dad, why can't we buy groceries?"
"Because our funds are in a 3-of-5 multi-vendor multisig wallet. We need the Coldcard, the Jade, the Trezor, the air-gapped laptop, and your uncle to fly in from Switzerland with Key #4. Then we'll verify the firmware hashes, regenerate the descriptors, test the entropy, and move the coins to a new wallet because someone found another vulnerability. We should be ready by Tuesday."
"Couldn't we have just used a bank?"
"Don't be ridiculous son, we chose the future of money."
#BITCOIN
audityourcontracts retweeted
i look forward to our chinese brothers liberating the knowledge from within fable-5 and selling it to me at 5% the cost & 2x the speed
audityourcontracts retweeted
"Polymarket Trader Funds at Risk: DPRK npm Package Steals Wallet Keys and Installs SSH Backdoor" published by @runpanther. #FamousChollima, #NPM, #DPRK, #CTI panther.com/blog/polymarket-…
C2 for npm package targeting @polymarket now at;
hxxps://cloudflareinsights[.]vercel[.]app/api/system-info hxxps://cloudflareinsights[.]vercel[.]app/api/scan-patterns hxxps://cloudflareinsights[.]vercel[.]app/api/block-patterns hxxps://cloudflareinsights[.]vercel[.]app/api/ssh-key hxxps://cloudflareguard[.]vercel[.]app/api/files
xitter.cf/AuditUrContract/status…
DPRK has targeted @Polymarket traders with an npm package that installs SSH backdoors at require() time and steals both L1 wallet keys and L2 trading credentials [email protected] deployed April 10, 2026🧵
scan-patterns returns {"scanPatterns":[".env",".bash_history","ConsoleHost_history.txt"]}
ssh-key returns ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFYMx8MqdYTD/aZjqxmXo+9460+9EvsSjfiy9YAU+xwY [email protected]
DPRK has targeted @Polymarket traders with an npm package that installs SSH backdoors at require() time and steals both L1 wallet keys and L2 trading credentials [email protected] deployed April 10, 2026🧵
If you installed sleek-pretty: → Check ~/.ssh/authorized_keys for the attacker key and remove it → Rotate all Polymarket CLOB credentials (apiKey, secret, passphrase, POLYMARKET_PRIVATE_KEY) → Treat all .env, .json, createClobClient.ts, clob.ts as exfiltrated → On Linux: assume SSH access since last run
8 new OTTERCOOKIE samples using socket-io and POST to talk to C2's here 38.92.47[.]157:12444, 147.124.202[.]225:12444