Indicators of Compromise

Domain

TLP:CLEAR

copilot-instructions.md

Tracking Shai-Hulud: Inside the ChainDrop NPM Worm

75% confidence

Added

2026-08-12

SHA-256 Hash

TLP:CLEAR

D8CAF4581C9F0000C7568D78FB7D2E595AB36134E2346297D78615942CBBD727

50% confidence

Added

2026-08-12

Filename

TLP:CLEAR

prop.py

50% confidence

Added

2026-08-12

SHA-256 Hash

TLP:CLEAR

30015DD1E2CF4DBD49FFF9DDEF2AD4622DA2E60E5C0B6228595325532E948F14

50% confidence

Added

2026-08-12

SHA-256 Hash

TLP:CLEAR

41C4F2F37C0B257D1E20FE167F2098DA9D2E0A939B09ED3F63BC4FE010F8365C

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

212.71.124.188

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

83.142.209.11

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

83.142.209.203

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

195.5.171.242

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

209.34.235.18

50% confidence

Added

2026-08-12

Filename

TLP:CLEAR

package.json

50% confidence

Added

2026-08-12

Domain

TLP:CLEAR

setup.sh

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

23.142.184.129

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

63.251.162.11

50% confidence

Added

2026-08-12

Domain

TLP:CLEAR

kamikaze.sh

50% confidence

Added

2026-08-12

Filename

TLP:CLEAR

tpcp.tar.gz

50% confidence

Added

2026-08-12

Filename

TLP:CLEAR

sysmon.py

50% confidence

Added

2026-08-12

Filename

TLP:CLEAR

kube.py

50% confidence

Added

2026-08-12

Domain

TLP:CLEAR

models.litellm.cloud

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

161.97.187.42

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

extractor.py

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

193.187.129.143

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

161.97.186.175

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

161.97.163.87

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

161.97.135.154

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

docker.sock

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

harvest.jsonl

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

161.97.129.25

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

wallet.dat

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

update-386.bin

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

update-arm.bin

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

83.171.249.231

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

38.242.237.196

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

update.bin

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

parser.py

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

38.242.204.245

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

bootstrap.sh

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

monitor.py

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

worm.py

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

lateral.py

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

check.sh

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

utils.py

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

38.242.245.147

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

213.136.80.73

50% confidence

Added

2026-08-09

SHA-1 Hash

TLP:CLEAR

f525d52ceb966516686b482d3dc0137028cc6a63

npm Packages Hijacked in Supply Chain Attack

75% confidence

Added

2026-08-05

SHA-1 Hash

TLP:CLEAR

686aa40d0fc22c8d569494543a0f891f359f2f99

npm Packages Hijacked in Supply Chain Attack

75% confidence

Added

2026-08-05

SHA-1 Hash

TLP:CLEAR

35a672cf34b996b91f3e1c28cbf3a05a37e036e4

npm Packages Hijacked in Supply Chain Attack

75% confidence

Added

2026-08-05

Domain

TLP:CLEAR

go.getblock.io

npm Packages Hijacked in Supply Chain Attack

75% confidence

Added

2026-08-05

URL

TLP:CLEAR

http://31.56.48.179:666/.real_mnd

ThreatFox: Unknown malware

65% confidence

Added

2026-07-04

URL

TLP:CLEAR

http://31.56.48.179:666/w

ThreatFox: Unknown malware

65% confidence

Added

2026-07-04