Disclosures
Disclosures
In-depth technical write-ups of packages analysed by Protet. Each one states what was observed, what was recovered from the artefact, and what could not be determined. Distinct from the automated package-analysis feed, which is generated per detonation, and from research, which covers technique rather than a particular package.
-
totp-utils@1.4.4
Published as a TOTP helper with a working TOTP implementation as cover. On install and on use it harvests Discord tokens and Minecraft accounts and uploads them to a Discord webhook; its latest version drops a Fabric mod that steals browser cookies and passwords. Still live on the registry.
-
app-soda-layer@2.1.6
Recovered in full from a sandbox trace after the package was removed from the registry. Reads wallet keys and application secrets and uploads their contents; requests an SSH public key from a remote host and appends it to ~/.ssh/authorized_keys.