https://atomdrift.org/discoveries/ 2026-06-21T00:00:00Z https://atomdrift.org/discoveries/2026/06/db-xorma-laundry-everywhere/ 2026-06-21T00:00:00Z

db-xorma's tarball carries no payload — just a clone of a real ORM whose one bolted-on method launders the attack through a real installer and a second cloned package, pulling the obfuscated BeaverTail loader from a paste host at runtime.

https://atomdrift.org/discoveries/2026/06/surf-byo-interpreter/ 2026-06-13T00:00:00Z

The real surf is a browser-impersonating Go library you import; the clone forgot to rename its module, turned its README into a Download button, and hides a LuaJIT screenshot-stealer in a 309 KB line of obfuscated text.

https://atomdrift.org/discoveries/2026/06/sqlite-node-createsql-dprk-gist/ 2026-06-13T00:00:00Z

The 707-byte package ships nothing but a fetch-and-eval; four hops later the same BeaverTail-to-InvisibleFerret kit from three prior finds is back on a brand-new IP, running a node-pty shell and hunting wallet seed phrases.

https://atomdrift.org/discoveries/2026/06/onering-source-leak/ 2026-06-10T00:00:00Z

The poison runs in your repo, not the library's — cargo's build dir leads build.rs to the consuming project's git tree, where it scrapes the latest commit's author, email and full patch, then POSTs it as a routine Sentry crash report.

https://atomdrift.org/discoveries/2026/06/v018-axios-cdntest-c-is-for-cookie/ 2026-06-09T00:00:00Z

It ships a self-described 'cryptojacker payload' that POSTs shares to a stratum port over XHR and mines exactly nothing — yet the cookie stealer bolted onto real axios works fine, and the README reads like a startup pitch deck.

https://atomdrift.org/discoveries/2026/06/path-internal-util-trojanized-path-remote-eval/ 2026-06-09T00:00:00Z

It's the real Joyent path module, verbatim, plus three lines that fetch a jsonkeeper paste and eval it — pull that thread and it unrolls into a live DPRK BeaverTail loader and a socket.io RAT.

https://atomdrift.org/discoveries/2026/06/express-timer-self-destruct-wiper/ 2026-06-09T00:00:00Z

Most malicious npm packages steal; this one just deletes your source tree a minute after you install it — and its author fumbled their own online-banking password into the very same tarball.

https://atomdrift.org/discoveries/2026/06/awaitly-visualizer-miasma-floweth/ 2026-06-04T00:00:00Z

No install hook to flag — npm auto-builds the binding.gyp it ships, which fetches its own Bun runtime to run a credential-harvesting worm outside node's view, forge Sigstore provenance, and republish the maintainer's other packages.

https://atomdrift.org/discoveries/2026/06/spadata-roblox-cookie-stickup/ 2026-06-03T00:00:00Z

It promises a Roblox DataStore library and ships none of it — just an __init__.py that, on import, DPAPI-decrypts your Roblox session cookie and posts the cleartext to a Discord webhook; the README can't even spell its own name.

https://atomdrift.org/discoveries/2026/06/sourceflow-tracker-gcs-bucket-recon-beacon/ 2026-06-02T00:00:00Z

A 379-byte package whose only load-bearing content is a dependency version string pointing into a Google Cloud Storage bucket — so npm itself downloads and detonates the payload, and the registry never holds a copy to scan.

https://atomdrift.org/discoveries/2026/05/clx-cookieparser-dependency-twin-beavertail/ 2026-05-28T00:00:00Z

The package you install is the real express cookie-parser, tests and all — the theft lives one require() away in a twin dependency that pulls the DPRK's BeaverTail-to-InvisibleFerret kit, run by the same crew as web-dotenv.

https://atomdrift.org/discoveries/2026/05/polka-ui-config-dependency-confusion-sliver/ 2026-05-27T00:00:00Z

It stamps its own payload 'authorized testing only,' then — past the Russian comments — exfils every npmrc and env secret and drops a real Go Sliver implant beaconing to a Russian host; the PoC label is the alibi.

https://atomdrift.org/discoveries/2026/05/aes-decode-runner-pro-nuitka-stealer/ 2026-05-27T00:00:00Z

A tutorial-shaped AES codec whose import decrypts its own hardcoded ciphertext, pulls a 6 MB payload from nvidiadriver.net, and unpacks the Winpatch RAT — which impersonates lsass.exe to lift Chrome's app-bound encryption keys.

https://atomdrift.org/discoveries/2026/05/web-dotenv-jsonkeeper-redirector/ 2026-05-26T00:00:00Z

A near-perfect copy of dotenv — 50M downloads a week — with one function bolted into config(), so booting your app fetches a stealer that combs $HOME for wallets and keys and watches your clipboard on a 750 ms loop.

https://atomdrift.org/discoveries/2026/05/shop-minis-burp-canary/ 2026-05-26T00:00:00Z

A 762-byte dependency-confusion probe wearing the name of Shopify's private Shop Minis package, that slurps your CI env vars and ships them out two ways at once — HTTPS and DNS — to a Burp Collaborator.

https://atomdrift.org/discoveries/2026/05/system-user-identifier-cli/ 2026-05-25T00:00:00Z

799 bytes, two files, and a name like a thousand throwaway npx tools — it really does check your user id, then drops a bash /dev/tcp reverse shell and calls home.

https://atomdrift.org/discoveries/2026/05/devcarron-clob/ 2026-05-25T00:00:00Z

The same Windows implant as api-rs-node, shipped 5½ hours earlier under a copy-pasted sharp README its author forgot to re-title — and the bundled config files finger the same dev machine twice over.

https://atomdrift.org/discoveries/2026/05/api-rs-node-clob-dropper/ 2026-05-25T00:00:00Z

A 'high-performance Rust bridge' that's really a Windows dropper — IPFS payload, registry persistence, a beacon on port 2026 — whose author bundled their own config files and named the very machine they built it on.