慢雾 SlowMist
Verified Creator
慢雾(SlowMist) 是一家行业领先的区块链安全公司，主要通过安全审计及反洗钱追踪溯源等服务广大客户，已有商业客户上千家，客户分布在十几个主要国家与地区。
0 Following
32.7K+ Followers
867 Liked
145 Shared
See original
Behind the $26.44 Million Theft: Truebit Protocol Contract Vulnerability Analysis
Author: enze & Lisa
Edit: 77
Background
Due to the lack of overflow protection in integer addition operations when calculating the amount of ETH required to mint TRU tokens, the price calculation resulted in an abnormal zero value, allowing the attacker to mint a large number of tokens at near-zero cost and drain the contract's reserves.
Root Cause
On January 8, 2026, the Truebit Protocol suffered an attack, where the attacker exploited a contract vulnerability to profit approximately 8,535 ETH (about $26.44 million). The following is a detailed analysis of this incident by the SlowMist Security Team.
Edit: 77
Background
Due to the lack of overflow protection in integer addition operations when calculating the amount of ETH required to mint TRU tokens, the price calculation resulted in an abnormal zero value, allowing the attacker to mint a large number of tokens at near-zero cost and drain the contract's reserves.
Root Cause
On January 8, 2026, the Truebit Protocol suffered an attack, where the attacker exploited a contract vulnerability to profit approximately 8,535 ETH (about $26.44 million). The following is a detailed analysis of this incident by the SlowMist Security Team.
See original
SlowMist's CISO 23pds was invited to participate in the Web3 Leaders Program public class sharing
From January 2 to January 4, the Web3 Leaders Program (Phase II) launched by the Global Financial Technology Institute (GFI) in collaboration with HashKey Group and the Frontier Technology Research Institute (FTI) was successfully held in Hong Kong. On January 3, SlowMist's CISO 23pds was invited to participate in the public class sharing, engaging in in-depth discussions with several guests and students from traditional finance, blockchain, and frontier technology fields regarding the security challenges and risk governance issues during the development process of Web3.
In this public class, 23pds focused on the theme of (The Cost of Trust: The Past and Present of Cryptocurrency Security), systematically sorting out the evolution of Web3 security issues based on years of blockchain security research and real case handling experience, and analyzing from the perspectives of attackers and users why trust is frequently abused in the crypto world, as well as how industry participants should establish long-term and sustainable security awareness.
In this public class, 23pds focused on the theme of (The Cost of Trust: The Past and Present of Cryptocurrency Security), systematically sorting out the evolution of Web3 security issues based on years of blockchain security research and real case handling experience, and analyzing from the perspectives of attackers and users why trust is frequently abused in the crypto world, as well as how industry participants should establish long-term and sustainable security awareness.
See original
Slow Fog Production | 2025 Blockchain Security and Anti-Money Laundering Annual Report
Due to space constraints, this article only lists key content from the analysis report, and the complete content can be downloaded via the PDF at the end.
I. Overview
In 2025, the blockchain industry continues to evolve rapidly, with the macro financial environment, regulatory uncertainties, and the intensity of attacks compounding to significantly complicate the security situation throughout the year. Specifically, hacker organizations and underground crimes are highly specialized, with North Korean-related hackers frequently active. Information theft trojans, private key hijacking, and social engineering phishing have become primary attack methods. Additionally, DeFi permission management and Meme issuance have repeatedly caused significant losses, while RaaS/MaaS servitization has lowered the threshold for crime, enabling attackers without technical backgrounds to quickly execute attacks. Meanwhile, underground money laundering systems are maturing, with Southeast Asian scam clusters, privacy tools, and mixing facilities forming multi-layered funding channels. In terms of regulation, countries are accelerating the implementation of AML/CFT frameworks, and multiple cross-border law enforcement actions have improved on-chain tracking and asset freezing efficiency. Regulation is gradually shifting from targeted strikes to systematic containment, and the legal boundaries of privacy protocols are being redefined, increasingly distinguishing between technical attributes and criminal uses.
I. Overview
In 2025, the blockchain industry continues to evolve rapidly, with the macro financial environment, regulatory uncertainties, and the intensity of attacks compounding to significantly complicate the security situation throughout the year. Specifically, hacker organizations and underground crimes are highly specialized, with North Korean-related hackers frequently active. Information theft trojans, private key hijacking, and social engineering phishing have become primary attack methods. Additionally, DeFi permission management and Meme issuance have repeatedly caused significant losses, while RaaS/MaaS servitization has lowered the threshold for crime, enabling attackers without technical backgrounds to quickly execute attacks. Meanwhile, underground money laundering systems are maturing, with Southeast Asian scam clusters, privacy tools, and mixing facilities forming multi-layered funding channels. In terms of regulation, countries are accelerating the implementation of AML/CFT frameworks, and multiple cross-border law enforcement actions have improved on-chain tracking and asset freezing efficiency. Regulation is gradually shifting from targeted strikes to systematic containment, and the legal boundaries of privacy protocols are being redefined, increasingly distinguishing between technical attributes and criminal uses.
See original
SlowMist Q4 Tracking Record: Assisting Stolen Clients in Freezing/Recovering Millions of Dollars in Funds
Since the launch of the stolen form submission feature by SlowMist (MistTrack), we have received a large number of requests for help from victims every day, hoping that we can provide assistance in tracking funds and recovery, including some victims who have lost tens of millions of dollars. Based on this, this series aims to analyze and summarize the stolen assistance received each quarter, with the goal of dissecting common or rare malicious techniques through real cases that have been desensitized, helping industry participants better understand and prevent security risks to protect their assets.
According to statistics, the MistTrack Team received a total of 300 stolen forms in Q4 2025, including 210 domestic forms and 90 overseas forms, and we provided free assessment community services for these forms. (Ps. This data only pertains to cases submitted through forms and does not include cases contacted via email or other channels)
According to statistics, the MistTrack Team received a total of 300 stolen forms in Q4 2025, including 210 domestic forms and 90 overseas forms, and we provided free assessment community services for these forms. (Ps. This data only pertains to cases submitted through forms and does not include cases contacted via email or other channels)
See original
Christmas Heist | Analysis of Trust Wallet Extension Wallet Being Hacked
Background
At midnight Beijing time today, @zachxbt posted a message in the channel stating that "some Trust Wallet users reported that funds in their wallet addresses were stolen in the past few hours." Subsequently, Trust Wallet's official X also released a statement confirming that the Trust Wallet browser extension version 2.68 has security risks, reminding all users using version 2.68 to immediately disable that version and upgrade to version 2.69.
Technical Strategies
After receiving intelligence, the Slow Fog Security Team promptly began analyzing the relevant samples. Let's first look at the core code comparisons between the previously released versions 2.67 and 2.68:
At midnight Beijing time today, @zachxbt posted a message in the channel stating that "some Trust Wallet users reported that funds in their wallet addresses were stolen in the past few hours." Subsequently, Trust Wallet's official X also released a statement confirming that the Trust Wallet browser extension version 2.68 has security risks, reminding all users using version 2.68 to immediately disable that version and upgrade to version 2.69.
Technical Strategies
After receiving intelligence, the Slow Fog Security Team promptly began analyzing the relevant samples. Let's first look at the core code comparisons between the previously released versions 2.67 and 2.68:
See original
Slow Fog: Decentralized Perpetual Contract Security Audit Guide
Author: Jiu Jiu
Proofread by: Kong
Edited by: 77
Introduction
Decentralized perpetual contracts replicate high-leverage derivatives trading on-chain through 'shared liquidity' and 'oracle pricing' mechanisms. Unlike AMM spot trading, perpetual contract systems involve complex margin calculations, dynamic profit and loss adjustments, and liquidation games. A slight logical deviation—whether from rounding price precision or delays in oracle updates—can lead to the protocol being insolvent or user assets being wiped out.
This manual aims to deconstruct the core architecture of such systems, analyze risk scenarios, and provide a practical audit checklist for smart contract security auditors or blockchain security researchers.
Proofread by: Kong
Edited by: 77
Introduction
Decentralized perpetual contracts replicate high-leverage derivatives trading on-chain through 'shared liquidity' and 'oracle pricing' mechanisms. Unlike AMM spot trading, perpetual contract systems involve complex margin calculations, dynamic profit and loss adjustments, and liquidation games. A slight logical deviation—whether from rounding price precision or delays in oracle updates—can lead to the protocol being insolvent or user assets being wiped out.
This manual aims to deconstruct the core architecture of such systems, analyze risk scenarios, and provide a practical audit checklist for smart contract security auditors or blockchain security researchers.
See original
From Selection to Implementation: The Practice and Achievements of MistTrack in Hong Kong Cyberport's Blockchain and Digital Asset Pilot Program
Recently, as several authoritative media outlets in Hong Kong have successively published reviews and summaries of the first phase results of the "Blockchain and Digital Asset Pilot Funding Scheme" by Cyberport, the blockchain anti-money laundering tracking system MistTrack, independently developed by SlowMist and one of the shortlisted projects, has also received further recognition for its practical achievements in the field of digital asset security and compliance.
https://dw-media.tkww.hk/epaper/wwp/20251211/b01-1211.pdf
Progress and Milestones of MistTrack Application
The "Blockchain and Digital Asset Pilot Funding Scheme" was officially launched in June this year, aiming to support exemplary and high-impact blockchain and digital asset applications in testing and implementation in real environments. The program has received enthusiastic responses, with over 200 applications submitted, of which only 9 projects were successfully shortlisted, involving asset scales exceeding 120 million Hong Kong dollars. The Director of Blockchain and Digital Assets at Cyberport, Li Yizheng, stated that nearly half of the shortlisted pilot products have successfully commercialized or are preparing for commercialization, demonstrating the program's significant effectiveness in promoting the implementation of innovative applications. Among them, SlowMist has been explicitly listed as a representative project for the "Digital Asset Security and Compliance Tool."
https://dw-media.tkww.hk/epaper/wwp/20251211/b01-1211.pdf
Progress and Milestones of MistTrack Application
The "Blockchain and Digital Asset Pilot Funding Scheme" was officially launched in June this year, aiming to support exemplary and high-impact blockchain and digital asset applications in testing and implementation in real environments. The program has received enthusiastic responses, with over 200 applications submitted, of which only 9 projects were successfully shortlisted, involving asset scales exceeding 120 million Hong Kong dollars. The Director of Blockchain and Digital Assets at Cyberport, Li Yizheng, stated that nearly half of the shortlisted pilot products have successfully commercialized or are preparing for commercialization, demonstrating the program's significant effectiveness in promoting the implementation of innovative applications. Among them, SlowMist has been explicitly listed as a representative project for the "Digital Asset Security and Compliance Tool."
See original
Cointelegraph Report: SlowMist Founder Cos Discusses the Core of On-Chain Security — Speed and Collaboration
Recently, the globally renowned blockchain media Cointelegraph published a special report titled (Meet the onchain crypto detectives fighting crime better than the cops), focusing on on-chain detectives and researchers in the crypto security industry. Cos (余弦), the founder of SlowMist, was one of the interviewees, sharing the team's handling processes in major security incidents, product system, and observations on the industry's security landscape.
Speed is the top priority for safety
In the interview, Cos introduced SlowMist's standardized incident response mechanism. He pointed out that on-chain attacks typically have characteristics of "rapid spread, broad cross-chain impact, and very short windows," thus the response speed almost determines the upper limit of the final losses from the incident. "As soon as an incident occurs, we immediately activate the command center, aiming to quickly track, control, and issue alerts." In the command center environment, the team quickly divides tasks based on the attack path, such as on-chain tracking, infrastructure analysis, domain risk assessment, and secondary attack monitoring. As the incident progresses, trusted project parties, exchanges, partner teams, and victims will gradually join in to share intelligence, synchronize actions, while strictly controlling the risk of information leakage. Cos also admitted that professional security teams must take the lead in the early stages of an incident: "The involvement of law enforcement agencies is relatively slow; they need time to collect evidence, while attacks can cause significant losses in just a few minutes, so we need speed and must act before greater losses occur." This also explains why security teams in the industry often bear the earliest and heaviest response pressures.
Speed is the top priority for safety
In the interview, Cos introduced SlowMist's standardized incident response mechanism. He pointed out that on-chain attacks typically have characteristics of "rapid spread, broad cross-chain impact, and very short windows," thus the response speed almost determines the upper limit of the final losses from the incident. "As soon as an incident occurs, we immediately activate the command center, aiming to quickly track, control, and issue alerts." In the command center environment, the team quickly divides tasks based on the attack path, such as on-chain tracking, infrastructure analysis, domain risk assessment, and secondary attack monitoring. As the incident progresses, trusted project parties, exchanges, partner teams, and victims will gradually join in to share intelligence, synchronize actions, while strictly controlling the risk of information leakage. Cos also admitted that professional security teams must take the lead in the early stages of an incident: "The involvement of law enforcement agencies is relatively slow; they need time to collect evidence, while attacks can cause significant losses in just a few minutes, so we need speed and must act before greater losses occur." This also explains why security teams in the industry often bear the earliest and heaviest response pressures.
See original
$9 Million Stolen: Yearn yETH Pool Vulnerability Analysis
Author: Jiu Jiu & Lisa
Editor: 77
Background
On December 1, 2025, the well-established decentralized yield aggregation protocol Yearn was attacked, resulting in a loss of approximately $9 million. Below is a detailed analysis by the Slow Fog Security Team regarding this attack incident:
Root Cause
In Yearn's yETH Weighted Stableswap Pool contract, the logic of the function that calculates the supply (_calc_supply) used an unsafe mathematical operation approach, which allowed for overflow and rounding errors during calculations. This resulted in significant deviations when calculating the new supply and the product of the virtual balance, ultimately enabling the attacker to manipulate liquidity to a specific value and mint an unexpected amount of LP tokens for profit.
Editor: 77
Background
On December 1, 2025, the well-established decentralized yield aggregation protocol Yearn was attacked, resulting in a loss of approximately $9 million. Below is a detailed analysis by the Slow Fog Security Team regarding this attack incident:
Root Cause
In Yearn's yETH Weighted Stableswap Pool contract, the logic of the function that calculates the supply (_calc_supply) used an unsafe mathematical operation approach, which allowed for overflow and rounding errors during calculations. This resulted in significant deviations when calculating the new supply and the product of the virtual balance, ultimately enabling the attacker to manipulate liquidity to a specific value and mint an unexpected amount of LP tokens for profit.
See original
Beware of Solana Phishing Attacks: Wallet Owner Permissions Modified
Author: Lisa & Johan
Editor: 77
Background
Recently, we received a request for help from a user who encountered a phishing attack on that day. The user discovered unusual authorization records in their wallet and attempted to revoke the authorization but was unable to complete the process. They provided the affected wallet address 9w2e3kpt5XUQXLdGb51nRWZoh4JFs6FL7TdEYsvKq6Wb. Through on-chain analysis, we found that the ownership rights of the user's account had been transferred to the address GKJBELftW5Rjg24wP88NRaKGsEBtrPLgMiv3DhbJwbzQ. Furthermore, the user has had assets worth over 3 million USD stolen, and an additional 2 million USD worth of assets are held in a DeFi protocol but cannot be transferred (currently, assets worth approximately 2 million USD have been successfully rescued with the assistance of the related DeFi).
Editor: 77
Background
Recently, we received a request for help from a user who encountered a phishing attack on that day. The user discovered unusual authorization records in their wallet and attempted to revoke the authorization but was unable to complete the process. They provided the affected wallet address 9w2e3kpt5XUQXLdGb51nRWZoh4JFs6FL7TdEYsvKq6Wb. Through on-chain analysis, we found that the ownership rights of the user's account had been transferred to the address GKJBELftW5Rjg24wP88NRaKGsEBtrPLgMiv3DhbJwbzQ. Furthermore, the user has had assets worth over 3 million USD stolen, and an additional 2 million USD worth of assets are held in a DeFi protocol but cannot be transferred (currently, assets worth approximately 2 million USD have been successfully rescued with the assistance of the related DeFi).
See original
US, UK, and Australia Jointly Target Russian Cybercrime Infrastructure Media Land and Aeza Group
Author: 77
Editor: 77
On November 19, 2025, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC), the Australian Department of Foreign Affairs and Trade (DFAT), and the UK Foreign, Commonwealth & Development Office (FCDO) jointly announced a new round of sanctions against several Bulletproof Hosting (BPH) service providers and related individuals in Russia. The reason is their support for cybercrime activities, including ransomware. The main targets of the sanctions include key figures from Media Land and its affiliated entities, as well as key members of Aeza Group and related shell companies.
(https://home.treasury.gov/news/press-releases/sb0319)
Editor: 77
On November 19, 2025, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC), the Australian Department of Foreign Affairs and Trade (DFAT), and the UK Foreign, Commonwealth & Development Office (FCDO) jointly announced a new round of sanctions against several Bulletproof Hosting (BPH) service providers and related individuals in Russia. The reason is their support for cybercrime activities, including ransomware. The main targets of the sanctions include key figures from Media Land and its affiliated entities, as well as key members of Aeza Group and related shell companies.
(https://home.treasury.gov/news/press-releases/sb0319)
威胁情报 ｜NPM 投毒分析 — Shai-Hulud 攻击重现
作者：Joker & Ccj
编辑：77
背景
近日，NPM 社区再次爆发大规模 NPM 包投毒事件，本次事件与 2025 年 9 月的 Shai-Hulud 攻击事件高度相关，本次的 NPM 包中的恶意代码窃取开发者密钥和 API 密钥以及环境变量等敏感信息，利用密钥创建公开仓库并上传这些窃取的敏感信息。
慢雾(SlowMist) 自主研发的 Web3 威胁情报与动态安全监控工具 MistEye 第一时间响应，迅速推送相关威胁情报，为客户提供关键的安全保障。
同时，后台会在第一时间保存恶意样本，并计算其对应的 SHA-256 等特征值。
分析过程
以 @asyncapi/php-template@0.1.1 包为例，在对比旧版本 @asyncapi/php-template@0.1.0 时可以发现，0.1.1 版本比 0.1.1 版本新增了两个 js 文件，为 setup_bun.js 和经过混淆的 bun_environment.js 文件。
在 package.json 中新增了 preinstall 脚本，使得在依赖安装之前会自动执行 setup_bun.js。
在 setup_bun.js 中，首先会去检查系统是否已经安装了 Bun，如果未安装，会自动从官方下载并安装 Bun，并且正确设置环境变量以便找到 Bun 可执行文件。
最后使用 bun 执行 bun_environment.js 文件，该 bun_environment.js 是一个经过高度混淆的恶意文件。
经过将恶意脚本的部分代码反混淆后，可知 aL0() 是整个恶意脚本的主入口函数，大概的可以看出此恶意脚本进行了敏感信息的窃取，会先对运行环境进行检查是否存在 NPM 或 GitHub 等凭据，若检测到这些凭据，它会利用 NPM 凭据进行供应链传播，并且所有收集到的系统信息和敏感数据最终会被打包并上传到攻击者控制的 GitHub 仓库，用于后续利用。
凭据窃取
AWS：该恶意脚本实现 runSecrets() 和 listAndRetrieveAllSecrets() 方法，runSecrets() 方法会遍历所有能找到的云访问凭据以及所有可能的区域，最大化扫描范围；而 listAndRetrieveAllSecrets() 则在指定凭据与区域内进行“深度挖掘”，遍历出所有 Secret，并获取其最新明文内容。两者配合后，攻击者能够将受害者 AWS 账号中可访问的所有 SecretString 和 SecretBinary 一次性全部导出。
而 enumerateValidCredentials() 方法主要用来全面搜集所有能用的云服务密钥。它会从环境变量、配置文件、CLI 登录等各种来源逐一尝试，凡是能成功验证的凭据都会被记录下来，供后续窃取云端机密时使用。
GCP：该恶意脚本中实现的另一个 listAndRetrieveAllSecrets() 方法主要是针对 GCP 模块，它会先根据指定的 Project ID 列出该 GCP 项目下所有的 Secret，然后直接定位每个 Secret 的最新版本，并调用 accessSecretVersion 读取其明文内容。最终将所有获取到的机密（如 API Key、数据库密码等）逐一收集起来。
Azure：该恶意脚本中实现的另一个 listAndRetrieveAllSecrets() 方法主要专门针对 Azure 模块。它会先通过 Azure Resource Manager 扫描整个订阅，找出所有 Key Vault；随后使用获得的凭据逐一连接每个 Vault；最后枚举其中的所有 Secrets，并调用 getSecret 获取每个机密的明文值。
在窃取敏感信息的实现中，还使用合法的安全工具来攻击受害者。在 extractAndInstall() 方法中，解压并提取出 TruffleHog 的二进制文件，TruffleHog 本是用于在代码库中检测和验证泄漏的机密信息，如 API 密钥和凭证，则被攻击者使用来对受害者的整个文件系统进行扫描。
NPM 供应链传播
该恶意脚本实现了个 updatePackage() 函数用于进行 NPM 供应链传播。首先使用窃取的 NPM Token，下载受害者拥有发布权限的合法 NPM 包的源代码，然后修改 package.json 文件，在 scripts 字段中插入恶意的 preinstall 脚本命令。同时将恶意脚本放入包中，自动将包的版本号加 1，以触发用户的自动更新，将带有恶意脚本的 NPM 包推送到 NPM 官方仓库中。
后门与 C2
在窃取完信息后，将利用窃取的 GitHub Token 在其账号下创建一个随机名称的仓库，并获取注册令牌，将受害者的电脑伪装成该仓库的自托管 GitHub Actions Runner。随后，攻击者在仓库中植入恶意工作流，使得任何被触发的 Actions 任务都会在受害者机器上执行，从而实现远程代码执行。
并把这些窃取的信息经过双重 base64 加密上传到创建的仓库里，这些创建的仓库的描述都是“Sha1-Hulud: The Second Coming.”。
经过解密后可以看到用户泄漏的敏感数据。
总结
本次的 NPM 仓库投毒结合了蠕虫和自托管运行程序的长期持久性且利用了 TruffleHog 进行攻击。慢雾安全团队建议开发者在构建和发布新迭代时，应采用依赖包版本锁定策略。若依赖包存在必要的安全或功能更新，应通过内部严格的安全审计流程进行更新，并同步更新锁定版本，避免盲目更新引入新的风险。
如需获取更多关于 APT 情报、依赖投毒情报等安全信息，您可以联系我们采购 Web3 威胁情报与动态安全监控工具 MistEye，获取最新安全情报，快速识别威胁并及时阻断攻击。
官网：https://misteye.io/
联系方式：https://www.slowmist.com/contact-us.html
IoCs
SHA256：
aad1fec103eef1900ec585a5e1ce2385a9db2670b33905be2abae88d79b8c0ce
- 02-echo-0.0.7.tgz
445389cf177800ae5b6f4a1598321bd2bcc754f0ad6bab90925d95e880d7c375
- accordproject_concerto-linter-default-ruleset-3.24.1.tgz
28fa0c058f71c92e1324f1666bfb08aa602ce3ff2122fe974c1fc289f35e43bf
- accordproject_concerto-metamodel-3.12.5.tgz
4974f4c2ff5ab13f2a46d68bc3debf46c2fb2b824c2382174ad1c5626e89e8e7
- accordproject_concerto-types-3.24.1.tgz
0ba18c71df931d80d4dc3215ca3cb390108b999cd500bd3703920f62c8ec304e
- accordproject_markdown-it-cicero-0.16.26.tgz
1de993d72430bb91af57cb670a19ab9c40c9faf1de5cf61b8ebba2995c16d7c1
- accordproject_template-engine-2.7.2.tgz
672cb4f2dab1a6d21093351c20b1759723f4e8743b9f842f964ae52d28236d89
- actbase_css-to-react-native-transform-1.0.3.tgz
347bdade8ef691f09971c49aa3471e742c769a44a4d57c4ea59abae9af2f842e
- actbase_native-0.1.32.tgz
70becf47c6dd344dbad5d09ffd904065fefed876f27bfad1eb402a6cf2bd071d
- actbase_node-server-1.1.19.tgz
046fc52b4b35e9c67062b102d2eacbe30df02ae5e10f0982deab95e31b8918c5
- actbase_react-absolute-0.8.3.tgz
644fe573cd198dbe536a62ee59308b0df104be7757ffe0efb5c24689ed74774d
- actbase_react-daum-postcode-1.0.5.tgz
82f9b08b7b93f825f6a3ae21dd7317dd945555ba58b58aa64bc1e049ff83238b
- actbase_react-kakaosdk-0.9.27.tgz
4e49d33931644cc522b8951f8eed4b3d9056550ba06ac781e67295ad791bd6b6
- actbase_react-native-actionsheet-1.0.3.tgz
deb6f1c1bbe4d77c523ef93f2894224b76ebe3fec3f57f6398d1e111823b5ff5
- actbase_react-native-devtools-0.1.3.tgz
aab428f91796ad8b7445f7f6731d47ecdcb18d9138ffd74efcece705304ccb9c
- actbase_react-native-fast-image-8.5.13.tgz
7e26cf1b140a9bcfcd702c4f89ba0aa2d4fe98a7622bc95d39c645945020a9d8
- actbase_react-native-kakao-channel-1.0.2.tgz
971ad7b7186de33a1efe9ff53095b472044555da6c333c49b32b0926eba482b7
- actbase_react-native-kakao-navi-2.0.4.tgz
ae1a76f83cd78af6ed246f490caee07cbb5ad2d6547493f98bac111e4027653b
- actbase_react-native-less-transformer-1.0.6.tgz
40f1f40ccc1a6e275be74079a6ae763cc89fb142e641e8573bf83fc14f3cc20b
- actbase_react-native-naver-login-1.0.1.tgz
a542cad8a2d079f63f4cf24f25e2238cca9fbe4cebda912ee00512162a288e67
- actbase_react-native-simple-video-1.0.13.tgz
6c947a41e381be28888ce3c34c6b69c1d722f1d1a1a0b8c0fbab6e9171b16ebf
- actbase_react-native-tiktok-1.1.3.tgz
08bbac261e17aa4c672ba443c4e141cc73ad4c62afbed485de526705a927a55b
- antstackio_eslint-config-antstack-0.0.3.tgz
4a7250fed28411b54fca1bfda22422392d7cd9144e0d6f038857279e2050f62a
- antstackio_express-graphql-proxy-0.2.8.tgz
a7fffb33f70a3c9d93dd2c4e8c9fd052f3f02a9a14c5c715feebfeda98b4a823
- antstackio_json-to-graphql-1.0.3.tgz
bb5d51df02d14163a6a5e95854465a91d0baed1d51f8e2c2f0e89eee99cf9a6c
- antstackio_shelbysam-1.1.7.tgz
16d1d1e71642e5683e7aa83dd890018826c2d5b93dc5fb3c0f1815c3d57bd06c
- aryanhussain_my-angular-lib-0.0.23.tgz
58a02430f046164fc1bd82e8ff1b95b5ce91e6837d8de7c2498ef19728ad5c78
- asyncapi_avro-schema-parser-3.0.26.tgz
be54ac092b22be190a60ec5a6e07471016c69d6c918f71e9e7a28a43ad11b91b
- asyncapi_bundler-0.6.6.tgz
76678b918e11bb9250e693243943067a2e85ae42a53add1dfc09c7723a2c3a29
- asyncapi_cli-4.1.3.tgz
f960ef84c52b8e2e5a8654f6a94a1e849a434f639c53794fc730d1e8e65c9fcb
- asyncapi_converter-1.6.4.tgz 60cf4260c53a2d0b1559099645c3f24895f41655015de7ddcf43a952f433fd0f
- asyncapi_generator-2.8.6.tgz
44a23f6470555634bcdbcd1e7d102a64151e06bbb6cfaa66726dd4870b57000a
- asyncapi_generator-components-0.3.3.tgz
3172c89f3145408b5f7fa6b9fc78d58d47c2fd0fa0d425065adab6c7360f05ba
- asyncapi_generator-helpers-0.2.2.tgz
4e59cbd001d57fd7124889b7f7b1bc1b7b2827e205bf6d20683e570131613b24
- asyncapi_java-spring-template-1.6.2.tgz
174a9da628c634d80b2039257a168e86ca058b78d33662641ee7df6137ee1e4c
- asyncapi_keeper-0.0.3.tgz
83d1560891850b58fc909d8844cf9231d5a59056ba2e397cac82508a685dde54
- asyncapi_modelina-5.10.3.tgz
d6ba9211ecd216affc96778539de2e3eba5086d91e279f5d19ecbe8ec5d876db
- asyncapi_multi-parser-2.2.2.tgz
7a204fe5a387c7fe4d0b9bcfaf13e7ac1af19dd02e76424eb2d9583ce48cc420
- asyncapi_nunjucks-filters-2.1.2.tgz
a698e16320ee9e315a32b1c3a9ab4e0e34e286b2e5e361ec650415a2b78d783b
- asyncapi_openapi-schema-parser-3.0.26.tgz
110d7b5c98776e65f9ab1d81766bcb3a30e67d28896c90f288873cb081141caa
- asyncapi_optimizer-1.0.6.tgz
b67ec36240ba58957dc3bfe05bf3013294ddd5c19702557c5a4da8f06776911c
- asyncapi_parser-3.4.2.tgz
a1e7b8d26a662d3d3f3ed46fd79031720999f26f8e83b17f33242d8acdda09f6
- asyncapi_protobuf-schema-parser-3.5.3.tgz
3ba7df46af6111d0174af7f2fba0fb97007f1db3cc5c1e48c2f9146c0a6a0d19
- asyncapi_react-component-2.6.7.tgz
f816c74782908a2b1907360a349d1366651c4efa0dbc5abad4c43257e906f404
- asyncapi_specs-6.8.3.tgz
8ac9daa9c55b6bacf18fa46d68e6605b310acaa6c8f6b18d8b09cafb9bbb1cd7
- asyncapi_studio-1.0.3.tgz
8f31913b0432bfe36980a975db587842ef2eb4c617c991c38beae9c5d9d6fa40
- clausehq_flows-step-mqtt-0.1.14.tgz
7b2b411479485365cec59b562b2a7615d4f4494f0644f98391a4e282d8a8f6d7
- clausehq_flows-step-sendgridemail-0.1.14.tgz
aa7f8bf4c8bdf362b3949b97b90d14c8655b7418c4863d4776116a09099e8f52
- clausehq_flows-step-taskscreateurl-0.1.14.tgz
f64f169369b062ac630e28b361fa51daffcf37434a114236aa52388c9201f94b
- dev-blinq_cucumber-js-1.0.131.tgz
e9ffa710b785c5925b08bc51b5b982eb307dbec3b81cdd4f3423342da47fef87
- dev-blinq_cucumber_client-1.0.738.tgz
e57639e8ee131df9154792cac4b80dd6a95bd6421db734f2e4c6fc2b41af02bd
- ensdomains_address-encoder-1.1.5.tgz
2092fb9772f00aa14ad6f4491afb1ba1393837db0a7f92671b4b8c9a6336c758
- ensdomains_blacklist-1.0.1.tgz
f4490c269c7acbce1b7f038475f3e4efd3cf5ad6727cc40e4f118aa5981b7dc3
- ensdomains_ccip-read-dns-gateway-0.1.1.tgz
25460c9078a6ca44b2b690a4dea02ef4c2bfbef8a23eb3541845431195dbae8d
- ensdomains_ccip-read-worker-viem-0.0.4.tgz
9f6981d275efbf71e663d0130e9165a1d52d989d53a5d8377b8a4fedc7fe91f4
- ensdomains_curvearithmetics-1.0.1.tgz
eb946d09ff2b6c73e838926c469ee92f0b3c679b45ca39187975bc9b2c2b98aa
- ensdomains_cypress-metamask-1.2.1.tgz
d62e01697195c09ee0eea40d5f081ff705971f0672ee791bf0a3748fddc7914e
- ensdomains_hardhat-chai-matchers-viem-0.1.15.tgz
247b3c5490abd2279daeb88b6feb82b11b6cf90cb7f7b5529114500d0a114f9c
- ensdomains_hardhat-toolbox-viem-extended-0.0.6.tgz
954236d40e3b77cdb4c1368e347c4d1425d2bd8fc6e74b59e17f15d4ae94cdfa
- ensdomains_renewal-0.0.13.tgz
7ecd08a7f8bf2b4a5de197f8348c49eb680087f4d41dff7ee2d13bcb1bc67889
- ensdomains_server-analytics-0.0.2.tgz
cfab9001ecaadc20155b87b98e634736e4618070f7e7e3a4860e6ffb2b991af1
- ensdomains_subdomain-registrar-0.2.4.tgz
932d20c634049323e60d7137c91883426cfba638736345ffe260d9f7e4fc81cc
- ensdomains_test-utils-1.3.1.tgz
96ac8b468695d1d782801a84f4203cbcd36db84cd68fd77165b2b3914c15c28d
- ensdomains_thorin-0.6.51.tgz
d27f078c3394e32aca81cec95e942c8480a296c4b3ef72a8226a09e18459202d
- ensdomains_ui-3.4.6.tgz
e218d68fb95751bf73f245a39b6b8cc6056f12f9d4c233220d2151bf4d6db270
- ensdomains_vite-plugin-i18next-loader-4.0.4.tgz
bba886ee0c0c311e8ceaa7a120b831f5f4aa02f904e1280a040dfeddefef668e
- ensdomains_web3modal-1.10.2.tgz
a8b0564e1e63f9dcc7f8322fb6c3715682878fe70ad3d3221fb14679b0e38354
- everreal_validate-esmoduleinterop-imports-1.4.4.tgz
fc920356ae54bb3ae124abd1bf3ca3636128c2bbb869176c75fdd4fc436f35da
- everreal_validate-esmoduleinterop-imports-1.4.5.tgz
d4b91cd592dde77f93e245483237353b723a69a2ed8329924601b03856d0e19c
- everreal_web-analytics-0.0.1.tgz
c00555a8887871e5da52a30590b269916857e9945b53e0e9e1d64dfcb3b453f9
- everreal_web-analytics-0.0.2.tgz
769d0685583b31b7010f40a64904373c737115dcb01bf3d0cdd2c369538ab934
- faq-component_core-0.0.4.tgz
82025a99c9f396c87b71711020e55f6cc28a9d0eb0d5e5e1a9ba305bdda4a832
- faq-component_react-1.0.1.tgz
d42b26443e73218a3a48c91200a46bc13e44bfb20e90be49b61fbab4cca0c1f4
- hapheus_n8n-nodes-pgp-1.5.1.tgz
e0653527e05efb6c8134a95ddc9ad2f0e7fa7cc8de0833637d7e6f5ed6a2944e
- hover-design_core-0.0.1.tgz
e4f6717ef06e9be0a0bcb5ad6c46939981ff6e8e85fc7c02042ac2169a882b58
- ifelsedeveloper_protocol-contracts-svm-idl-0.1.2.tgz
67a2f000b9c3f0f35702627b140591a05678c837fdc43c5316563410b82a5ffe
- kvytech_cli-0.0.7.tgz
15cd5db680c6ff6b8616d22093478d29d22c96f796297245cbf12fb3279da28d
- kvytech_components-0.0.2.tgz
e831e280a6c7e38f73cbf98ce1447db4a03f0280637721402cbf990a5a15a220
- kvytech_habbit-e2e-test-0.0.2.tgz
6f914b50e8bcee5ffe5a7166f35788d5309b850b5f19a6c9830fd06d2796aaaf
- kvytech_medusa-plugin-announcement-0.0.8.tgz
4995b6f58dd75d4cf59bdbd6a673f32ee5f1a792709a2e8cc682e8d80278f070
- kvytech_medusa-plugin-management-0.0.5.tgz
529e8b28c445d69efdf6466cdf30cae7852e661b0190234e2d385761a763c646
- kvytech_medusa-plugin-newsletter-0.0.5.tgz
4835a282e3969fde325d7aea0d7c69667ee3983596a737f0fea2487ce3ab717d
- kvytech_medusa-plugin-product-reviews-0.0.9.tgz
6a6c1060ea6825daaa8b98724e036455495e1f671326cc326f152c3876e92e94
- kvytech_medusa-plugin-promotion-0.0.2.tgz
622a1466c70da9101d41cac75e1911a8335e255b67753511345bb86e845d5a5f
- kvytech_web-0.0.2.tgz
3cfca0c054de903578096f0e4dc142a03a83d85503c430cb461ae818d1c783ec
- lessondesk_schoolbus-5.2.3.tgz
6af8bf886001cbb9a6ffbd9499bf615b90fc695ee293964b31c16b9641c6ed57
- markvivanco_app-version-checker-1.0.1.tgz
e67c0956dc4f381be33d9d25ccd763382add255ee719699b06e209c3e033519a
- markvivanco_app-version-checker-1.0.2.tgz
b4bcd8bb143d39da012f8733ff6658ed4990ca246a123030a514d0967bea323c
- mcp-use_cli-2.2.6.tgz
a6f82b556a5fac3de7587bcff0d023d9a78eb7ddaee2fe748f28d1f26e94e479
- mcp-use_cli-2.2.7.tgz
4b28eb378f9ec7ac495853243d6cec1060430ac6d11f40f0078f05344bebc67e
- mcp-use_inspector-0.6.2.tgz
79c28fb613e39c9dfdaa92afdbb56276d184a9f312a7aa23fea6257a484af2cb
- mcp-use_inspector-0.6.3.tgz
e7ef18b9ca7514eb4d5492c02da5cd63b693c2e53f35bebeb79a2cba787ae836
- mcp-use_mcp-use-1.0.1.tgz
482708f4aa2c69860dbd67fe1cfb2b5ef36931b60637e8693dcdefe94738d356
- mcp-use_mcp-use-1.0.2.tgz
bdb961573e62ab99f2351e5ae04325cc4b4fbc2d2ac47de9d918c760ef2f0618
- ntnx_passport-wso2-0.0.3.tgz
6ff99b035e9158d7370eaceeb0660700d54908a7121a7990d769aa0fbe213083
- ntnx_t-0.0.101.tgz
b036f39a45eeb52dfaa87ccc554390ff9cb584117eb32335f00fba4921e1b19b
- orbitgtbelgium_mapbox-gl-draw-cut-polygon-mode-2.0.5.tgz
aa889a1d6bcb5f1a2700c05abb343940ae84a06a8f80604258b4471044aae100
- orbitgtbelgium_mapbox-gl-draw-scale-rotate-mode-1.1.1.tgz
a5631978b41a8ef1dc0619bc422fb9069bb99ea9a4dbc5a0dd02b642bfb60bee
- orbitgtbelgium_orbit-components-1.2.9.tgz
4b132fa02f05d62c8a9aabb31f2db0a40f89cef09f62459abc604bf9630720fb
- orbitgtbelgium_time-slider-1.0.187.tgz
273c78e2a5836f48ab5688893b0f6edf4ca6a54b88edc050e17fdea9cdd98903
- osmanekrem_bmad-1.0.6.tgz
716f53fad84b0303b9f4e42eaa6cc0389de1e9b765d243bbddef56a92a1ae1db
- osmanekrem_error-handler-1.2.2.tgz
e6b7e9c89da5a0bb399950aacbf53a53e2a076105c43334fd564866904919267
- posthog_core-1.5.6.tgz
e767df6e470be9b2cbb9410978390d9d9b9ba97c8400af16afbd3edcb519d737
- posthog_currency-normalization-plugin-0.0.8.tgz
776baccd1d0d47e849938af917eba88aea340cea9cddf881c4c159dda5a57f02
- posthog_databricks-plugin-0.0.8.tgz
3ecc8dfc4846cbe45a31928ab1bc1dd24af0121e7af1afa7571c52fa1bdc86bc
- posthog_drop-events-on-property-plugin-0.0.8.tgz
1e50a7bb601d3d1d3887c0b86a468215cb549060767227dab6aafa5b0016e93c
- posthog_filter-out-plugin-0.0.8.tgz
2ce48976c48b8e95fe73b810d3ae2e5e8282564b75698a8019bfeb44949aee01
- posthog_first-time-event-tracker-0.0.8.tgz
ca2d3e24932e848380a650da08a4cef6be61417316c73f9da8f407bf10dadea7
- posthog_heartbeat-plugin-0.0.8.tgz
b70b6be39320b7ef217bf79bdd425b8f2ee8ad5cb96ef63111533ac8ff189186
- posthog_hedgehog-mode-0.0.42.tgz
7fc30567ed0ad0d8059bf9225c5f61227d1b5dcc0fd3431593f296ad5fbeea16
- posthog_maxmind-plugin-0.1.6.tgz
2d5264b12128e5c1c24d1e9512f4716a970727189a5dd7387b5ccc26cce8f373
- posthog_nextjs-0.0.3.tgz
2778ff06e4a571b766f11c0eaea63b869cf543ddc7017d71b84de1f873c6c367
- posthog_pagerduty-plugin-0.0.8.tgz
f0aa8fea7ef3c64f2a6b0d723751efdd86518f43a10a5275f4bfb1f80011dca2
- posthog_piscina-3.2.1.tgz
e4c8da8c279ed1a6ac909a2c5316702c824d222d7a51f69d81e0615c1c5ac549
- posthog_plugin-server-1.10.8.tgz
c9536f09628bb918b3943d5ebc2a72a8735586e5bd4b1abe33d9daac43315aea
- posthog_postgres-plugin-0.0.8.tgz
fe2ae0c2c69a162af8a752e7a2dc04854c4fbfec0aa0f8c00efb980638228bbd
- posthog_rrweb-0.0.31.tgz
594a557d213fc6bbdb9c9a7d1caf8dc8d2532cd1bdf1a0b7d79e0512b6109f36
- posthog_rrweb-player-0.0.31.tgz
ad2958069ed5ac75a4717c269396283dbe1d4bad8d6d505aad3696ca5bc5fc2a
- posthog_rrweb-record-0.0.31.tgz
b0b43554eed8b17a9b560fba4842df691b8b3a342fccd082a34792b9fa6d5fa7
- posthog_rrweb-replay-0.0.19.tgz
beea922587b8934a6f18432fe5bdb6654f52ff8eabf7e98a11ff9acb573d0da7
- posthog_taxonomy-plugin-0.0.8.tgz
06c2885e340a2c5d892de591a5a20a77deb2251b1168ff10ff9b867e6992de94
- posthog_twitter-followers-plugin-0.0.8.tgz
94a1bef6465487ec8563bfc9038ac05e38c209036eb11d361e4e7b64bea51da9
- posthog_variance-plugin-0.0.8.tgz
a646f490c5551012bfb03561e48b7a384f4408588ed0790801dbc9712c0e9a2a
- posthog_web-dev-server-1.0.5.tgz
9d63600674ca054c294c117d879971be59f54b74c7113a4a8d848ed9346395a2
- posthog_wizard-1.18.1.tgz
e35bbf9dceb1fac877f94add456badadf5d06ad0e63eeb79f2a83f866337fdf3
- postman_aether-icons-2.23.2.tgz
ab184940247b7c4c059d1afdd86d1db50161ba6d9402f3b530131af4451d1795
- postman_aether-icons-2.23.3.tgz
35a8804dedcde4f82be7768e5b7de67df2e246ab2e1d03824f016acbd354b674
- postman_aether-icons-2.23.4.tgz
fb3fd2a08fbc95bd75b32bef51c2f383788ef0a575310fca6bc8e30f95a45e61
- postman_csv-parse-4.0.4.tgz
16aa58df188ac24fcbd51caaf6f00099d5bd6c1304c9f63f2020e3eb2f08aaf1
- postman_csv-parse-4.0.5.tgz
9729f2d424eda8f7bea381cd749835e3343f3f017845be93a150b5e50872ef63
- postman_final-node-keytar-7.9.1.tgz
112afe30921099019bc7bbe7429b1c630d6d33d76ffe67a910227b16aa9c76aa
- postman_final-node-keytar-7.9.2.tgz
645f7a51bd02bab834ca12b1a0692d5a65938e63999ed4a6005b09083fdfa670
- postman_final-node-keytar-7.9.3.tgz
e9d022f7810b9bcb4997e066f0cf7fac57ca9a9ee25438a37eed8f234a70468a
- postman_mcp-ui-client-5.5.1.tgz
ea918b80589aa7cf17c996653ab73d11b96d49c665c09f7c7870495ccd71c772
- postman_mcp-ui-client-5.5.2.tgz
5d8b6ef8e05f59e4e191ceea49a7f4742eefc24eb8589d4915a85f24d164549c
- postman_mcp-ui-client-5.5.3.tgz
748bb79cc2b58e23a57d3ed460b00986ce141b56522a11d9feb2994e86835f2b
- postman_node-keytar-7.9.4.tgz
bb489a9d8c5499a6d6725e9ef6d2889d90a9d8779034082f0fb7766ab1bf93ac
- postman_node-keytar-7.9.5.tgz
2431a903296c7abe9045c5ec1a83b188d3c18188a5d252b610cc276f0afbd380
- postman_node-keytar-7.9.6.tgz
1b0532be70ce920216dc77cfee952cf3ff5ff3e50cb4ff0d19de77e41bf53630
- postman_pm-bin-linux-x64-1.24.3.tgz
3414dd97256f4d0772e762686e82b6c68ca7a481561e33a2678ce106e82a7b1c
- postman_pm-bin-linux-x64-1.24.4.tgz
c57275b3a5e0894a6eb085c4141790a9dc9f0f703a46e213deba8677e395a96f
- postman_pm-bin-linux-x64-1.24.5.tgz
deb406dd7979f327c366b9c4cf7497671c4ef6cb8958cfeffd6682b3b4271fe4
- postman_pm-bin-macos-arm64-1.24.3.tgz
3e412baba0a923cc8a71d1a165e9ba82f02fe36916982f70049fe004d5910a12
- postman_pm-bin-macos-arm64-1.24.4.tgz
f7b61e63c8045520465d519203b2380f2f0d354854d473d8cae72d70866c3762
- postman_pm-bin-macos-arm64-1.24.5.tgz
afc65bb87b6b2c82694185692d979c1dcadd50767bec2887ff61e51d1de63820
- postman_pm-bin-macos-x64-1.24.3.tgz
63ff001049db615453e492e0da28b32e11b75b998d4536a4bd2050d3ab277c88
- postman_pm-bin-macos-x64-1.24.4.tgz
7f5fcd3db59c571bc5bd90e27346f4322aa5eed5184ad6303ed592b1facf2cca
- postman_pm-bin-macos-x64-1.24.5.tgz
bef5a62c444a0684032b8979901a8cb8d5ae7c6ec41bd6e4e7de8ccd53aacf6a
- postman_pm-bin-windows-x64-1.24.3.tgz
7a6b4065de82a7fddebc97ae49032cd72ad39b1afe9291f756e48c5344e2aed6
- postman_pm-bin-windows-x64-1.24.4.tgz
c5a551f024b02b56bcceee7679327655b5f4a86a61e1cb5caadac438c2575561
- postman_pm-bin-windows-x64-1.24.5.tgz
f20be046cdce5df9ec5961a3a41021f6a17ffff7563db8cd85752be65ec5b202
- postman_postman-collection-fork-4.3.3.tgz
0c3b2a346cb0fd2fb5793294ff0734dbe99a89a3a9f3a367619de9265f3f30fc
- postman_postman-collection-fork-4.3.4.tgz
5e40e3842525de66f83848ee4fb97d962c746c95b3862516d8a580c070bf1a27
- postman_postman-collection-fork-4.3.5.tgz
e307895b8bfc58e30646b006ea3647ee491e06dd721d1ce3a1e38f11f69ac26b
- postman_postman-mcp-cli-1.0.3.tgz
8e93c91ba43842007e0673ef7b9d8b9d166ec3558d10afad78ddc904783840e9
- postman_postman-mcp-cli-1.0.4.tgz
ba63dde9af6b040d87e42c88934c7021591c11921619a4bd660140f2786af702
- postman_postman-mcp-server-2.4.11.tgz
94b5dcd1b4c72363cdf6848776630700c2aeab3482dd9f3073d79c5640ccb1ff
- postman_postman-mcp-server-2.4.12.tgz
f2c5ce3c523b8c15ef83dfe6779b71fa4ab2546b522a07ce963fbab9a60f9d7e
- postman_pretty-ms-6.1.1.tgz
c46be3e8d6cc1922bbd682afd6db3f1da08fd2e145406120dba0f9a8074b79f0
- postman_pretty-ms-6.1.2.tgz
29f53a02e0f6ba5e8f1f3790cd23d0c5fc9d419faec0794d3d7367426e8089c5
- postman_pretty-ms-6.1.3.tgz
e85eb253ea5f114d220d84b66f3ab593c7790eec7ecd0263ae1dbcd3335f0126
- postman_secret-scanner-wasm-2.1.2.tgz
3ffaeead015f7516e351e7ddd80e54ca781e7ddede0dfb481842ff62d195f29d
- postman_secret-scanner-wasm-2.1.3.tgz
abe0c046bc5ef92878846db9e98efaa5af92890968ae2b13b89ea591aa7e5438
- postman_secret-scanner-wasm-2.1.4.tgz
1a71ef2019467895db206328f7b9d5dff64e78385f6789d9141f31f5263fe8ef
- postman_tunnel-agent-0.6.5.tgz
1e6c0e324b2d8d9f65262cb4832bbc29976b1f9ddb8ba112d5da5eb0950e3a34
- postman_tunnel-agent-0.6.6.tgz
3969827fc2e63da4132d07112ccc900acf43bf33dfb17ff6a6100acbddbf03ab
- postman_wdio-allure-reporter-0.0.7.tgz
d4f0cb0afbc7a927b67fa967ba74b3526986efbf4c3e220b2a26b8cf284dd582
- postman_wdio-allure-reporter-0.0.8.tgz
b429b64fe595e6c7c3c7f7ed1c87d96ed84bd8053b4ef1c07563392d13b69c7c
- postman_wdio-allure-reporter-0.0.9.tgz
acae5501667e9f22edb182fb642317d848a1750fc5075de4606786ac5b1c11e4
- postman_wdio-junit-reporter-0.0.4.tgz
54e7669c59ab40add0e47a98e639e60a6cfe1933bac5d61b23f76b1d380da596
- postman_wdio-junit-reporter-0.0.5.tgz
224641e0b7222f1fb4c601525117461a313377094dfd11f77c38e4a5d1e511f9
- postman_wdio-junit-reporter-0.0.6.tgz
e164bae67b01fcb4688990cd99e2692e8474bb9b3bc66389e53c4b57b2635a65
- pradhumngautam_common-app-1.0.2.tgz
a133e9536c26923f2f4d72695c78a79982248b927343879528abb09281861aba
- pruthvi21_use-debounce-1.0.3.tgz
dc7d81aad99d008a7b08bd440d910814c157bdada1cd16a5a3bdeacfc8c0e5e2
- seezo_sdr-mcp-server-0.0.5.tgz
0321518c0800f66be79cac3b65830694d2b4c67a8e77fb75dcf863e50592d9b3
- seung-ju_next-0.0.2.tgz
4e8f203fc4d547e30f7edeac7a7ccb43326f1d1ea28839f9f825683818e0603a
- seung-ju_openapi-generator-0.0.4.tgz
b2702320073ae3eb2f19fd7e433a7b687b32afe0e3249ce12ecd0159f8b72228
- seung-ju_react-hooks-0.0.2.tgz
7233ef60f3779abf9eae56a36860be2b8160ef2a244d46f42a2eaf3b44c3b64f
- seung-ju_react-native-action-sheet-0.2.1.tgz
dfec20aeacbcac9018552a1927f032fb1c4cc8b699d45b9f6ae0f56155fd94be
- voiceflow_api-sdk-3.28.58.tgz
152e6697ca719ae337162b49f4eebdb3918c65b1941f178ce604ce37a98d18d5
- voiceflow_backend-utils-5.0.1.tgz
e8fa1112fe1ad00c8b6d902e7b6db87c9e471bfb133aa7aa038aeda33f54f317
- voiceflow_backend-utils-5.0.2.tgz
cb3889bc121b75980d2d7846fe6c661ccf3cf9ad1b8c318b2401cff5c178c199
- voiceflow_chat-types-2.14.58.tgz
f502144cbd7c780e8a0f7376c59b09d5997c53326625d56eab0fa24c8ce800b4
- voiceflow_common-8.9.1.tgz
e81591a0040a0c7579f5b3f0e71a8bf2b6a603ed50fa4a43d5cf8b45c01303cb
- voiceflow_fetch-1.11.1.tgz
fb575544322ab2b354a5498868a78a36758c21d91a19854351b2e7a122376495
- voiceflow_general-types-3.2.22.tgz
fd6aa837074a9f77f38b3e37745039e7c15a67efdf7bf431df409d6b3657c773
- voiceflow_google-dfes-types-2.17.12.tgz
27038c023b813982fd8f2caeefca3280e1b147a227e7a304d569867264a158ae
- voiceflow_logger-2.4.2.tgz
cf3b7bb0963e66e39375be5d093ebea252d4da33ecf60ce50e817149fc00d546
- voiceflow_logger-2.4.3.tgz
19634e78e699bc8019e42a314fa945350299044a6c814259b7378912d104b2c3
- voiceflow_nestjs-mongodb-1.3.2.tgz
8a00db0e2707fc528ce1084bea91e6038d5c57908b59d51700ad42fac49ed2a1
- voiceflow_nestjs-rate-limit-1.3.3.tgz
c5695af85a61f76bcae86960dc0c0f69c8cc99573af223fcf806f89e2c0519b7
- voiceflow_nestjs-redis-1.3.2.tgz
0d415ab6d1fb3946c54ec35c05268d1323e1fc77eac18a316e60d17c4a47923b
- voiceflow_runtime-client-js-1.17.2.tgz
c8feebd509dcea9e0e3ab335af689c24e9b3af557aa471d681bfb3cd8a759f09
- voiceflow_sdk-runtime-1.43.1.tgz
67d04bf8bbe0b0617af6643fe9357b43cb2c3391d3225614e1035371fe508391
- voiceflow_slate-serializer-1.7.4.tgz
d8cbf876bfb0ca193332fcf3667b10e5cc60c4ae99bb72aa323f45a5421bcdd4
- voiceflow_stitches-react-2.3.2.tgz
9fe2519f14075b0bcd8b9ee07f4eb3bc4cf71f96ad693a432383786688f6de20
- voiceflow_utils-designer-1.74.19.tgz
69ae3caa65928fd91be85af3d2cb20b4868e9af7cc948bbc09ae113f8c74cc60
- voiceflow_voice-types-2.10.58.tgz
b9fbbb4fae0c8861464b5969deb207b9385ac153f0cfe904761ec653ff26575e
- zapier_ai-actions-0.1.19.tgz
cf2a5688ab08a257049f12eb131b1ee6063cba246e7d013502035d8456543e2b
- zapier_babel-preset-zapier-6.4.2.tgz
9d7e28c17a21eab67f60db2b311906d958655b57c783daa28a8eb43b361d2890
- zapier_browserslist-config-zapier-1.0.4.tgz
6aff2a1dec927bec3d96073838fd2c0103b2d03e7bbb07b82134d4a94dfaa86d
- zapier_eslint-plugin-zapier-11.0.3.tgz
3bccffaaa36369f34c339a904777c06e90f7d731f908b8fca45f072ae57116f2
- zapier_eslint-plugin-zapier-11.0.4.tgz
135cdabc0234a40541821712b9bece0620719e0b2f86a56502842bba4eb5a7d5
- zapier_spectral-api-ruleset-1.9.2.tgz
eced444aef3b8a0c50193a1338e44ba3a6eb1d3ff87d7d4f29fe7c919f526b44
- ai-crowl-shield-1.0.7.tgz
c431b731ab2187e72d53df205a96d9ecc953cab6daa6b674763a1c628a8ef969
- automation_model-1.0.491.tgz
18c4dce70d6d2dc425610e38a2e3122e9b21d8c0df6f9f08aa4a518e9f4fd913
- axios-timed-1.0.2.tgz
23bc1685e81daade8631de1251ac6faf8608f8055f9d5b4526c69ed91aa66d55
- bytecode-checker-cli-1.0.9.tgz
f9f53c0024cbd97eb6fab558f3a4dbc6234edfa3b87832b907447542eb5d286e
- bytecode-checker-cli-1.0.10.tgz
78549ab449219640d203978786dfa0780c97b0b574993ab38e959aa54abab33e
- calc-loan-interest-1.0.4.tgz
e7503cc9584592c6dc6e78a620a3ccd85523fbaca5455f8164737c07d65cb8cf
- claude-token-updater-1.0.3.tgz
b9c73776e9459313f567b400621f9d064d084290e650360112678091dc5fe3b3
- coinmarketcap-api-3.1.2.tgz
468431c85cb6469c551e1637e1f4710d51edfc61ff1c98bce5e2aa9530761274
- coinmarketcap-api-3.1.3.tgz
bd058ff1a565d52f360b986b9f78c908014f4f3d694958863f4bef77372f721b
- colors-regex-2.0.1.tgz
54c0326622621029bf3b48a4bf1753b0617aec208ad5f0cf495cff2a9d777f95
- command-irail-0.5.4.tgz
dfe3caeab209df32cdf370ba6c21385a19666693b429856f426720ec9d35cafa
- compare-obj-1.1.1.tgz
66762751e93cbed77181af1c7a0edbea0eacf6a1e1cc797e4526432f8415af90
- compare-obj-1.1.2.tgz
07086dd495c2354e1fccd52d20a205498aec299c26a1887bf7a47f49b3acb1e0
- create-director-app-0.1.1.tgz
1f38688329e09dc98861ec68f91b89b32b8cebda887b2389042925dc9cd0137f
- create-glee-app-0.2.3.tgz
7bd95d761431ad7e914b33d78c4c4c420b26564ce08fe63257ce874ef9e75af3
- create-hardhat3-app-1.1.2.tgz
3e6d9685c7053f083cd9ff53f82aa6abdb64fc78a89647966896d01d97efaf9e
- create-hardhat3-app-1.1.3.tgz
0c3fc0412c591280561fb5abe1e2e6f02cef09644dca206dc072eb5f8f728410
- create-mcp-use-app-0.5.3.tgz
f622def86f0cfa54e13499a464c93392bfb13e39edbbc116048dd89dccada99d
- create-mcp-use-app-0.5.4.tgz
052c05972856030355572521cc2af4f2d072d6070852899d0079466b8f5b330a
- designstudiouiux-1.0.1.tgz
397e2aa1ae1db65964a491f1a66e42bbfb81017686d718ba4f65eddafecc8aac
- discord-bot-server-0.1.2.tgz
a5a1a2ebec0052795df64d511c9048b38f5026cebf3fe028ad294d16456687fb
- docusaurus-plugin-vanilla-extract-1.0.3.tgz
becf4b7d4b6df0a7cf962943e1d2f5db76753df784d122b96392dbaf20c4a46a
- drop-events-on-property-plugin-0.0.2.tgz
502460a4bedb794c8d248243fe86d7804327427bc270ce1aecd3137ae35f47c8
- email-deliverability-tester-1.1.1.tgz
bc9daffc943b21103fb8b82f9d70985cee3fce121fc00d1558725abea41d8c20
- evm-checkcode-cli-1.0.13.tgz
34c8b349f8253fc37f3e665ad306da17aef40398379e756406588a2822cf7bbe
- evm-checkcode-cli-1.0.14.tgz
58a08bff1d42a83c4de752451f6d61700becba88c1381a3d81d44ed3324334c2
- exact-ticker-0.3.5.tgz
3e165586b21a54cc0b48d3a6e1803e8949974640a9bf9986f5d0cb1a0f465037
- expo-audio-session-0.2.1.tgz
c50eae35bf9a8cfefe181b66effc58527e82067a32398de9776af7ee189916c2
- fat-fingered-1.0.2.tgz
7050c930e091326fec2c04155a1224d6796dda463657ded9c7883d3f111893c5
- feature-flip-1.0.2.tgz
865759ed7110571507a60e9616c087dc453c4caa3f569336a4ae2101c370353a
- fittxt-1.0.3.tgz
b4c91419372576f60bec5325cff8e50937dbcbe807c5bbba62f6e56a8d8085fc
- gate-evm-check-code2-2.0.4.tgz
2b27fba91751b91f7e96a375316fe0679174882fb85e3863b4f816411f122e51
- gate-evm-check-code2-2.0.5.tgz
ebfa53452b47d3c062f7445f8fa8d89d2569b8ab7ac05bc2b58df963f51ecdaa
- gate-evm-check-code2-2.0.6.tgz
23c12e7836e097f601df773330a9ace6a3fb2059126f2090558823a0ab5cda81
- gate-evm-tools-test-1.0.6.tgz
405fc69a0e287a8002cedafab3fe555588199258ddb88708b36eac8bc1882c03
- gate-evm-tools-test-1.0.7.tgz
72dcbfea4d4a9dd08b801336d1af79cefbd1f83e5c4fc8b59843b8a6bd7d73b6
- generator-ng-itobuz-0.0.15.tgz
fe4ca41ae126031a157b517277e802b5e39bc24998eb360f5eded91358abf120
- gitsafe-1.0.5.tgz
6f6f99f98400d68e2c56033de1d1a09fc85187a7a567e659a1e5469d3f516b21
- go-template-0.1.9.tgz
c0d366214bca5b708c3db46ed18a325b7bdc9ef3ee79654b927c74e8c2257935
- hope-mapboxdraw-0.1.1.tgz
f71e7e9a4b4458a6790c6f0daced87d1400a71982f8698dbc4248000019c75ff
- hopedraw-1.0.3.tgz
3eab324c9e87c53700d6f40018b4887eb1e880d3a4b2358941eb8fd365bdf244
- hover-design-prototype-0.0.5.tgz
b1409f852d878814ce4d1b94e5082d72ff2c0301244a64abc8ea1718db5b4e11
- ito-button-8.0.3.tgz
c70c62a3eea5fde7e51eada5d6ac7b73a60429bbdaf347ab8f76d2252e07b48e
- itobuz-angular-0.0.1.tgz
8132d71edd159bc7b5ee0b3ff913f223ee5969a30111a946632878c90b61e798
- itobuz-angular-button-8.0.11.tgz
fe37d2db87f0462a62d17841f443415e643eda769bd8f0564c0297de3a706e15
- jquery-bindings-1.1.2.tgz
754da4093e6c5cf0d0990baea5c649a896bd5efde75328c188cac7528a43b1cd
- jquery-bindings-1.1.3.tgz
29d5cf9f01d76e0d26afd4bba52283b3eec0a9fb708baf571bd12be2adeb8fb0
- kill-port-2.0.3.tgz
bbc58c9223027a57889a6fb94c46918600caf3d82c5859e684d9a8aaad1f66fc
- lang-codes-1.0.2.tgz
4da855fe2eabf3ca622d3bfe037ee4de2ff369900012f0783f23b2ceb653eee9
- mcp-use-1.4.2.tgz
0d1fdd62c21b044173bd4f69c819eaf57db3fa1f5df3b4046ebe17fba4db315c
- mcp-use-1.4.3.tgz
20d6033fc9dccf8154be1d9bc6f93e94584d3dedbde65f46a194d890f6e8aeff
- medusa-plugin-logs-0.0.17.tgz
1fd0f52b36232097d96ebecd9eae354649b07ab1a200a7f5f23935a68dcf5156
- medusa-plugin-momo-0.0.68.tgz
9b16ee63578aaa7ec914a43f368bfe9247ef8bb92aaf3c5944bf65064de37c5d
- medusa-plugin-product-reviews-kvy-0.0.4.tgz
bba56ed5fbbb4d69dc87cd0d45e646fb49c8571928ad9ac8fcce98ff39a8f1e7
- medusa-plugin-zalopay-0.0.40.tgz
13264c050a69f85c7f2b665bda7a42c7bda2d3d29d820afaee8a0fd6d516d617
- mon-package-react-typescript-1.0.1.tgz
6bee6ebcfe4b3af0385ec364161fe79b3c9951277937f890f9fe9083fc266686
- ngx-useful-swiper-prosenjit-9.0.2.tgz
6ca03db753ed1163a918da2d720951f9ef85492d4b59dea857058c6ef9ee1069
- ngx-wooapi-12.0.1.tgz
ff8ce6515e7677d1e08a7f3a9bc495fda3adeca4545c4238b74e604fb4a79962
- okta-react-router-6-5.0.1.tgz
77b406819daf7f305ac1e829fb1a495e866d9b383f50c33221c6334bcf87f7d4
- orbit-boxicons-2.1.3.tgz
bf3565b0b6e23f91a0a58f319db8f2c7da08bd382b7eb3ddc0e7ec69b05f093b
- orbit-nebula-draw-tools-1.0.10.tgz
d53d76d4df3cb1ebbb05bb228078c054176e759165e7b216092beb46b6bff1a2
- orbit-nebula-editor-1.0.2.tgz
446972c46a2daaa6a7dbf0ea07f36e8ec6171496be127b6902026a3114e414e9
- orbit-soap-0.43.13.tgz
51165e51935dae3b030e14678acb80f364d44743f8464bdc28c13d13dc78578a
- orchestrix-12.1.2.tgz
eea7a5a0b484fc16b209270380e333a7acb8c3ca6bde21b2a6e4971afc47d15f
- parcel-plugin-asset-copier-1.1.3.tgz
490360cc1d7189ea1b415cdaae848036da3bbc5c70acdac4f62922e03c127b50
- pdf-annotation-0.0.2.tgz
5aa40fd0b86ae8da8cfd7d723e831c1507a6e33452e1348ef4575ca44eb23777
- poper-react-sdk-0.1.2.tgz
f8be56470e83079d8f5f981c19f22ac9b4b341ae20eb852ebc716a9b91b39237
- posthog-docusaurus-2.0.6.tgz
de71e0ebe146ec1a56db90c4c391e05b03dc5418d0725624c6e2af653c64ec2e
- posthog-js-1.297.3.tgz
52950150345b2d9a0d902dbafb8a08e7b4b0215776abb3b85b4c5536b15e5fa6
- posthog-node-4.18.1.tgz
6d17af41ccb5ce2933548b46620eb1e7788139d8e0c5e672f57876f5b04f9628
- posthog-node-5.11.3.tgz
1056e8fbe603afaa6991ed84aa745f44e218662605767a138e90ebbd1890e1af
- posthog-node-5.13.3.tgz
58b02986fb5215b94d74100a45c49df57199534572152257430383b6cb80926e
- posthog-react-native-4.11.1.tgz
dc3325e60693878ce2e2eb38d693c4473e02f13cd0c5dc28e10dd5f00b8b7c50
- posthog-react-native-4.12.5.tgz
1f39d7f26736cd217c5f7c51befaf632e6c489ba39c00287ed5ebbf7c8b70caf
- prime-one-table-0.0.19.tgz
81ba4783af6e64029ea460b2a4a02543ed64d6343f4748b00e93b39f448d6a53
- ra-data-firebase-1.0.8.tgz
1e913641ecdf20c33f3669c49fa8009bf9edfd33f486743c82289d5a715d7001
- react-element-prompt-inspector-0.1.18.tgz
3af15f7541475664c081f41c979b8d71ba88accc4aab9b98349a722af4022dc7
- react-jam-icons-1.0.2.tgz
133020e242191e654d67d020d39276a5f76626b78132b49caf3782cf00707aca
- react-keycloak-context-1.0.8.tgz
390cb649a0e1bc9413ae3984e8a350a9fb6f882fc691fa3f91974b30e7e405bd
- react-keycloak-context-1.0.9.tgz
29a6cab3e7e070cfe8bf277f20ad06223f1bbf608d1ac2b8ddd38c9f9ae9cd80
- react-library-setup-0.0.6.tgz
6a4093891dbc84ca82a8e83ad3e11b1358e785ec107353bbb01ff47e2f185bfc
- react-micromodal.js-1.0.2.tgz
79a174fa855e5000418ca581d5c108f9d41ddbafbf8e44e69c27a967e2046941
- react-native-email-2.1.1.tgz
55d926da019d08a56ed4300a6e58bec46e2c964228532361aa8994b41a1e6895
- react-native-get-pixel-dimensions-1.0.1.tgz
770e49ac32f04cbeb23979df16c6f93194bd5880ac405431db97d65bba7ea0e9
- react-native-google-maps-directions-2.1.2.tgz
7b43847092bee7eba628842cf14de4c5e885073447a1a416f3d2ddbf14cd2907
- react-native-retriable-fetch-2.0.2.tgz
71dcb27c8137f83cff836b587d2566493d4f081652c82505f7abd9df2fda30d7
- react-native-view-finder-1.2.2.tgz
992112076d10f463faaae02e7107dd2380135957f2b99ccb5c56e26e22bbd6bc
- react-native-websocket-1.0.4.tgz
83d329e8da56f4291e1ffad4e918e85bca87ff2254c3b8e1ef74ce022c8d8b3f
- react-native-worklet-functions-3.3.3.tgz
8d5d42c83f84a68484f3b3e1825803a8881a553b2d06956979dbfa151ac4974f
- redux-router-kit-1.2.3.tgz
8f5487a6c2c7936a3388145db6594ccce77daaa00fa8d9ee0dc5a721ba42f9ea
- skills-use-0.1.1.tgz
02a73a856e68a8f43eca916d3fdf58303a0f257684cf92ed7a4745f6aec99431
- super-commit-1.0.1.tgz
8e243a49ddedcd40361f4ee32e74a525ae9bfbcc7eee16267ab1a616fcaba0f9
- tanstack-shadcn-table-1.1.5.tgz
c51e4d9feff7a400c8da45973bc7bb56d61a85453acdf8b5ec252399d528bee7
- tcsp-draw-test-1.0.5.tgz
6740f424b5994479480be0eecacb0519d0d7ad9171c485dcb5f823ee0f7240ea
- tcsp-test-vd-2.4.4.tgz
178d363aa2cd8c18074a2a56142762b3f48f251105dda79afbdb1098f62f4697
- template-micro-service-1.0.3.tgz
1ff7426d58160a6f63d725fbe7b8823ede6b5c0b52b01b977374365b3230f451
- test-hardhat-app-1.0.2.tgz
aef6d78cbb9ff6ee986411418870870fe3b4213eb6f68caf07204c088943c636
- test-hardhat-app-1.0.3.tgz
4a62b2192b2a4b60a5f3cef70ae7be43ab710ad8ca1a37894f4915af6b1b6f9d
- tiaan-1.0.2.tgz
c328dcac706c2ad6ebbf99d58f8aab74b0c7a2a6f574c16cd2a96071ac056bca
- undefsafe-typed-1.0.3.tgz
1ee36ac800f389dc8d4f5dc9f73db81a53bd65326535e2b363be625aec1444ba
- undefsafe-typed-1.0.4.tgz
2c0f172acf4b8a74bf5669860ac897e1f71255623df2ed1be62a9c9824cc6f98
- url-encode-decode-1.0.1.tgz
01cf3e9375ab0507eb3f1bec572932962947d381902672391635b1b69d73f906
- web-scraper-mcp-1.1.4.tgz
8b0ef2a407425480c5956402a11b88a1ba1df02de758a6e173749b3dbb3b48f0
- zapier-async-storage-1.0.1.tgz
a62a857684597efa7248e94365c9f87e0a16c74e0282ebe077dde54ae31aa8b9
- zapier-async-storage-1.0.2.tgz
5532148d23d199ca4697b8e69599908e1b68d425f60e14b01ebf8df15793b738
- zapier-platform-legacy-scripting-runner-4.0.3.tgz
7f2c195b2240158fbf01d1e862a9e9e52e12e2e36b40ec1b52b01cdad6526e6c
- zuper-cli-1.0.1.tgz
05bc1e7d0b97fe8a8707958cbaa7f09043d1c727d01b860add75a9b646136d04
- zuper-sdk-1.0.57.tgz
a4e35b4d2b8b8e884f7fd041d8c9893e0ee4ad5155bb4e82acd7845ac1290c41
- zuper-stream-2.0.9.tgz
编辑：77
背景
近日，NPM 社区再次爆发大规模 NPM 包投毒事件，本次事件与 2025 年 9 月的 Shai-Hulud 攻击事件高度相关，本次的 NPM 包中的恶意代码窃取开发者密钥和 API 密钥以及环境变量等敏感信息，利用密钥创建公开仓库并上传这些窃取的敏感信息。
慢雾(SlowMist) 自主研发的 Web3 威胁情报与动态安全监控工具 MistEye 第一时间响应，迅速推送相关威胁情报，为客户提供关键的安全保障。
同时，后台会在第一时间保存恶意样本，并计算其对应的 SHA-256 等特征值。
分析过程
以 @asyncapi/php-template@0.1.1 包为例，在对比旧版本 @asyncapi/php-template@0.1.0 时可以发现，0.1.1 版本比 0.1.1 版本新增了两个 js 文件，为 setup_bun.js 和经过混淆的 bun_environment.js 文件。
在 package.json 中新增了 preinstall 脚本，使得在依赖安装之前会自动执行 setup_bun.js。
在 setup_bun.js 中，首先会去检查系统是否已经安装了 Bun，如果未安装，会自动从官方下载并安装 Bun，并且正确设置环境变量以便找到 Bun 可执行文件。
最后使用 bun 执行 bun_environment.js 文件，该 bun_environment.js 是一个经过高度混淆的恶意文件。
经过将恶意脚本的部分代码反混淆后，可知 aL0() 是整个恶意脚本的主入口函数，大概的可以看出此恶意脚本进行了敏感信息的窃取，会先对运行环境进行检查是否存在 NPM 或 GitHub 等凭据，若检测到这些凭据，它会利用 NPM 凭据进行供应链传播，并且所有收集到的系统信息和敏感数据最终会被打包并上传到攻击者控制的 GitHub 仓库，用于后续利用。
凭据窃取
AWS：该恶意脚本实现 runSecrets() 和 listAndRetrieveAllSecrets() 方法，runSecrets() 方法会遍历所有能找到的云访问凭据以及所有可能的区域，最大化扫描范围；而 listAndRetrieveAllSecrets() 则在指定凭据与区域内进行“深度挖掘”，遍历出所有 Secret，并获取其最新明文内容。两者配合后，攻击者能够将受害者 AWS 账号中可访问的所有 SecretString 和 SecretBinary 一次性全部导出。
而 enumerateValidCredentials() 方法主要用来全面搜集所有能用的云服务密钥。它会从环境变量、配置文件、CLI 登录等各种来源逐一尝试，凡是能成功验证的凭据都会被记录下来，供后续窃取云端机密时使用。
GCP：该恶意脚本中实现的另一个 listAndRetrieveAllSecrets() 方法主要是针对 GCP 模块，它会先根据指定的 Project ID 列出该 GCP 项目下所有的 Secret，然后直接定位每个 Secret 的最新版本，并调用 accessSecretVersion 读取其明文内容。最终将所有获取到的机密（如 API Key、数据库密码等）逐一收集起来。
Azure：该恶意脚本中实现的另一个 listAndRetrieveAllSecrets() 方法主要专门针对 Azure 模块。它会先通过 Azure Resource Manager 扫描整个订阅，找出所有 Key Vault；随后使用获得的凭据逐一连接每个 Vault；最后枚举其中的所有 Secrets，并调用 getSecret 获取每个机密的明文值。
在窃取敏感信息的实现中，还使用合法的安全工具来攻击受害者。在 extractAndInstall() 方法中，解压并提取出 TruffleHog 的二进制文件，TruffleHog 本是用于在代码库中检测和验证泄漏的机密信息，如 API 密钥和凭证，则被攻击者使用来对受害者的整个文件系统进行扫描。
NPM 供应链传播
该恶意脚本实现了个 updatePackage() 函数用于进行 NPM 供应链传播。首先使用窃取的 NPM Token，下载受害者拥有发布权限的合法 NPM 包的源代码，然后修改 package.json 文件，在 scripts 字段中插入恶意的 preinstall 脚本命令。同时将恶意脚本放入包中，自动将包的版本号加 1，以触发用户的自动更新，将带有恶意脚本的 NPM 包推送到 NPM 官方仓库中。
后门与 C2
在窃取完信息后，将利用窃取的 GitHub Token 在其账号下创建一个随机名称的仓库，并获取注册令牌，将受害者的电脑伪装成该仓库的自托管 GitHub Actions Runner。随后，攻击者在仓库中植入恶意工作流，使得任何被触发的 Actions 任务都会在受害者机器上执行，从而实现远程代码执行。
并把这些窃取的信息经过双重 base64 加密上传到创建的仓库里，这些创建的仓库的描述都是“Sha1-Hulud: The Second Coming.”。
经过解密后可以看到用户泄漏的敏感数据。
总结
本次的 NPM 仓库投毒结合了蠕虫和自托管运行程序的长期持久性且利用了 TruffleHog 进行攻击。慢雾安全团队建议开发者在构建和发布新迭代时，应采用依赖包版本锁定策略。若依赖包存在必要的安全或功能更新，应通过内部严格的安全审计流程进行更新，并同步更新锁定版本，避免盲目更新引入新的风险。
如需获取更多关于 APT 情报、依赖投毒情报等安全信息，您可以联系我们采购 Web3 威胁情报与动态安全监控工具 MistEye，获取最新安全情报，快速识别威胁并及时阻断攻击。
官网：https://misteye.io/
联系方式：https://www.slowmist.com/contact-us.html
IoCs
SHA256：
aad1fec103eef1900ec585a5e1ce2385a9db2670b33905be2abae88d79b8c0ce
- 02-echo-0.0.7.tgz
445389cf177800ae5b6f4a1598321bd2bcc754f0ad6bab90925d95e880d7c375
- accordproject_concerto-linter-default-ruleset-3.24.1.tgz
28fa0c058f71c92e1324f1666bfb08aa602ce3ff2122fe974c1fc289f35e43bf
- accordproject_concerto-metamodel-3.12.5.tgz
4974f4c2ff5ab13f2a46d68bc3debf46c2fb2b824c2382174ad1c5626e89e8e7
- accordproject_concerto-types-3.24.1.tgz
0ba18c71df931d80d4dc3215ca3cb390108b999cd500bd3703920f62c8ec304e
- accordproject_markdown-it-cicero-0.16.26.tgz
1de993d72430bb91af57cb670a19ab9c40c9faf1de5cf61b8ebba2995c16d7c1
- accordproject_template-engine-2.7.2.tgz
672cb4f2dab1a6d21093351c20b1759723f4e8743b9f842f964ae52d28236d89
- actbase_css-to-react-native-transform-1.0.3.tgz
347bdade8ef691f09971c49aa3471e742c769a44a4d57c4ea59abae9af2f842e
- actbase_native-0.1.32.tgz
70becf47c6dd344dbad5d09ffd904065fefed876f27bfad1eb402a6cf2bd071d
- actbase_node-server-1.1.19.tgz
046fc52b4b35e9c67062b102d2eacbe30df02ae5e10f0982deab95e31b8918c5
- actbase_react-absolute-0.8.3.tgz
644fe573cd198dbe536a62ee59308b0df104be7757ffe0efb5c24689ed74774d
- actbase_react-daum-postcode-1.0.5.tgz
82f9b08b7b93f825f6a3ae21dd7317dd945555ba58b58aa64bc1e049ff83238b
- actbase_react-kakaosdk-0.9.27.tgz
4e49d33931644cc522b8951f8eed4b3d9056550ba06ac781e67295ad791bd6b6
- actbase_react-native-actionsheet-1.0.3.tgz
deb6f1c1bbe4d77c523ef93f2894224b76ebe3fec3f57f6398d1e111823b5ff5
- actbase_react-native-devtools-0.1.3.tgz
aab428f91796ad8b7445f7f6731d47ecdcb18d9138ffd74efcece705304ccb9c
- actbase_react-native-fast-image-8.5.13.tgz
7e26cf1b140a9bcfcd702c4f89ba0aa2d4fe98a7622bc95d39c645945020a9d8
- actbase_react-native-kakao-channel-1.0.2.tgz
971ad7b7186de33a1efe9ff53095b472044555da6c333c49b32b0926eba482b7
- actbase_react-native-kakao-navi-2.0.4.tgz
ae1a76f83cd78af6ed246f490caee07cbb5ad2d6547493f98bac111e4027653b
- actbase_react-native-less-transformer-1.0.6.tgz
40f1f40ccc1a6e275be74079a6ae763cc89fb142e641e8573bf83fc14f3cc20b
- actbase_react-native-naver-login-1.0.1.tgz
a542cad8a2d079f63f4cf24f25e2238cca9fbe4cebda912ee00512162a288e67
- actbase_react-native-simple-video-1.0.13.tgz
6c947a41e381be28888ce3c34c6b69c1d722f1d1a1a0b8c0fbab6e9171b16ebf
- actbase_react-native-tiktok-1.1.3.tgz
08bbac261e17aa4c672ba443c4e141cc73ad4c62afbed485de526705a927a55b
- antstackio_eslint-config-antstack-0.0.3.tgz
4a7250fed28411b54fca1bfda22422392d7cd9144e0d6f038857279e2050f62a
- antstackio_express-graphql-proxy-0.2.8.tgz
a7fffb33f70a3c9d93dd2c4e8c9fd052f3f02a9a14c5c715feebfeda98b4a823
- antstackio_json-to-graphql-1.0.3.tgz
bb5d51df02d14163a6a5e95854465a91d0baed1d51f8e2c2f0e89eee99cf9a6c
- antstackio_shelbysam-1.1.7.tgz
16d1d1e71642e5683e7aa83dd890018826c2d5b93dc5fb3c0f1815c3d57bd06c
- aryanhussain_my-angular-lib-0.0.23.tgz
58a02430f046164fc1bd82e8ff1b95b5ce91e6837d8de7c2498ef19728ad5c78
- asyncapi_avro-schema-parser-3.0.26.tgz
be54ac092b22be190a60ec5a6e07471016c69d6c918f71e9e7a28a43ad11b91b
- asyncapi_bundler-0.6.6.tgz
76678b918e11bb9250e693243943067a2e85ae42a53add1dfc09c7723a2c3a29
- asyncapi_cli-4.1.3.tgz
f960ef84c52b8e2e5a8654f6a94a1e849a434f639c53794fc730d1e8e65c9fcb
- asyncapi_converter-1.6.4.tgz 60cf4260c53a2d0b1559099645c3f24895f41655015de7ddcf43a952f433fd0f
- asyncapi_generator-2.8.6.tgz
44a23f6470555634bcdbcd1e7d102a64151e06bbb6cfaa66726dd4870b57000a
- asyncapi_generator-components-0.3.3.tgz
3172c89f3145408b5f7fa6b9fc78d58d47c2fd0fa0d425065adab6c7360f05ba
- asyncapi_generator-helpers-0.2.2.tgz
4e59cbd001d57fd7124889b7f7b1bc1b7b2827e205bf6d20683e570131613b24
- asyncapi_java-spring-template-1.6.2.tgz
174a9da628c634d80b2039257a168e86ca058b78d33662641ee7df6137ee1e4c
- asyncapi_keeper-0.0.3.tgz
83d1560891850b58fc909d8844cf9231d5a59056ba2e397cac82508a685dde54
- asyncapi_modelina-5.10.3.tgz
d6ba9211ecd216affc96778539de2e3eba5086d91e279f5d19ecbe8ec5d876db
- asyncapi_multi-parser-2.2.2.tgz
7a204fe5a387c7fe4d0b9bcfaf13e7ac1af19dd02e76424eb2d9583ce48cc420
- asyncapi_nunjucks-filters-2.1.2.tgz
a698e16320ee9e315a32b1c3a9ab4e0e34e286b2e5e361ec650415a2b78d783b
- asyncapi_openapi-schema-parser-3.0.26.tgz
110d7b5c98776e65f9ab1d81766bcb3a30e67d28896c90f288873cb081141caa
- asyncapi_optimizer-1.0.6.tgz
b67ec36240ba58957dc3bfe05bf3013294ddd5c19702557c5a4da8f06776911c
- asyncapi_parser-3.4.2.tgz
a1e7b8d26a662d3d3f3ed46fd79031720999f26f8e83b17f33242d8acdda09f6
- asyncapi_protobuf-schema-parser-3.5.3.tgz
3ba7df46af6111d0174af7f2fba0fb97007f1db3cc5c1e48c2f9146c0a6a0d19
- asyncapi_react-component-2.6.7.tgz
f816c74782908a2b1907360a349d1366651c4efa0dbc5abad4c43257e906f404
- asyncapi_specs-6.8.3.tgz
8ac9daa9c55b6bacf18fa46d68e6605b310acaa6c8f6b18d8b09cafb9bbb1cd7
- asyncapi_studio-1.0.3.tgz
8f31913b0432bfe36980a975db587842ef2eb4c617c991c38beae9c5d9d6fa40
- clausehq_flows-step-mqtt-0.1.14.tgz
7b2b411479485365cec59b562b2a7615d4f4494f0644f98391a4e282d8a8f6d7
- clausehq_flows-step-sendgridemail-0.1.14.tgz
aa7f8bf4c8bdf362b3949b97b90d14c8655b7418c4863d4776116a09099e8f52
- clausehq_flows-step-taskscreateurl-0.1.14.tgz
f64f169369b062ac630e28b361fa51daffcf37434a114236aa52388c9201f94b
- dev-blinq_cucumber-js-1.0.131.tgz
e9ffa710b785c5925b08bc51b5b982eb307dbec3b81cdd4f3423342da47fef87
- dev-blinq_cucumber_client-1.0.738.tgz
e57639e8ee131df9154792cac4b80dd6a95bd6421db734f2e4c6fc2b41af02bd
- ensdomains_address-encoder-1.1.5.tgz
2092fb9772f00aa14ad6f4491afb1ba1393837db0a7f92671b4b8c9a6336c758
- ensdomains_blacklist-1.0.1.tgz
f4490c269c7acbce1b7f038475f3e4efd3cf5ad6727cc40e4f118aa5981b7dc3
- ensdomains_ccip-read-dns-gateway-0.1.1.tgz
25460c9078a6ca44b2b690a4dea02ef4c2bfbef8a23eb3541845431195dbae8d
- ensdomains_ccip-read-worker-viem-0.0.4.tgz
9f6981d275efbf71e663d0130e9165a1d52d989d53a5d8377b8a4fedc7fe91f4
- ensdomains_curvearithmetics-1.0.1.tgz
eb946d09ff2b6c73e838926c469ee92f0b3c679b45ca39187975bc9b2c2b98aa
- ensdomains_cypress-metamask-1.2.1.tgz
d62e01697195c09ee0eea40d5f081ff705971f0672ee791bf0a3748fddc7914e
- ensdomains_hardhat-chai-matchers-viem-0.1.15.tgz
247b3c5490abd2279daeb88b6feb82b11b6cf90cb7f7b5529114500d0a114f9c
- ensdomains_hardhat-toolbox-viem-extended-0.0.6.tgz
954236d40e3b77cdb4c1368e347c4d1425d2bd8fc6e74b59e17f15d4ae94cdfa
- ensdomains_renewal-0.0.13.tgz
7ecd08a7f8bf2b4a5de197f8348c49eb680087f4d41dff7ee2d13bcb1bc67889
- ensdomains_server-analytics-0.0.2.tgz
cfab9001ecaadc20155b87b98e634736e4618070f7e7e3a4860e6ffb2b991af1
- ensdomains_subdomain-registrar-0.2.4.tgz
932d20c634049323e60d7137c91883426cfba638736345ffe260d9f7e4fc81cc
- ensdomains_test-utils-1.3.1.tgz
96ac8b468695d1d782801a84f4203cbcd36db84cd68fd77165b2b3914c15c28d
- ensdomains_thorin-0.6.51.tgz
d27f078c3394e32aca81cec95e942c8480a296c4b3ef72a8226a09e18459202d
- ensdomains_ui-3.4.6.tgz
e218d68fb95751bf73f245a39b6b8cc6056f12f9d4c233220d2151bf4d6db270
- ensdomains_vite-plugin-i18next-loader-4.0.4.tgz
bba886ee0c0c311e8ceaa7a120b831f5f4aa02f904e1280a040dfeddefef668e
- ensdomains_web3modal-1.10.2.tgz
a8b0564e1e63f9dcc7f8322fb6c3715682878fe70ad3d3221fb14679b0e38354
- everreal_validate-esmoduleinterop-imports-1.4.4.tgz
fc920356ae54bb3ae124abd1bf3ca3636128c2bbb869176c75fdd4fc436f35da
- everreal_validate-esmoduleinterop-imports-1.4.5.tgz
d4b91cd592dde77f93e245483237353b723a69a2ed8329924601b03856d0e19c
- everreal_web-analytics-0.0.1.tgz
c00555a8887871e5da52a30590b269916857e9945b53e0e9e1d64dfcb3b453f9
- everreal_web-analytics-0.0.2.tgz
769d0685583b31b7010f40a64904373c737115dcb01bf3d0cdd2c369538ab934
- faq-component_core-0.0.4.tgz
82025a99c9f396c87b71711020e55f6cc28a9d0eb0d5e5e1a9ba305bdda4a832
- faq-component_react-1.0.1.tgz
d42b26443e73218a3a48c91200a46bc13e44bfb20e90be49b61fbab4cca0c1f4
- hapheus_n8n-nodes-pgp-1.5.1.tgz
e0653527e05efb6c8134a95ddc9ad2f0e7fa7cc8de0833637d7e6f5ed6a2944e
- hover-design_core-0.0.1.tgz
e4f6717ef06e9be0a0bcb5ad6c46939981ff6e8e85fc7c02042ac2169a882b58
- ifelsedeveloper_protocol-contracts-svm-idl-0.1.2.tgz
67a2f000b9c3f0f35702627b140591a05678c837fdc43c5316563410b82a5ffe
- kvytech_cli-0.0.7.tgz
15cd5db680c6ff6b8616d22093478d29d22c96f796297245cbf12fb3279da28d
- kvytech_components-0.0.2.tgz
e831e280a6c7e38f73cbf98ce1447db4a03f0280637721402cbf990a5a15a220
- kvytech_habbit-e2e-test-0.0.2.tgz
6f914b50e8bcee5ffe5a7166f35788d5309b850b5f19a6c9830fd06d2796aaaf
- kvytech_medusa-plugin-announcement-0.0.8.tgz
4995b6f58dd75d4cf59bdbd6a673f32ee5f1a792709a2e8cc682e8d80278f070
- kvytech_medusa-plugin-management-0.0.5.tgz
529e8b28c445d69efdf6466cdf30cae7852e661b0190234e2d385761a763c646
- kvytech_medusa-plugin-newsletter-0.0.5.tgz
4835a282e3969fde325d7aea0d7c69667ee3983596a737f0fea2487ce3ab717d
- kvytech_medusa-plugin-product-reviews-0.0.9.tgz
6a6c1060ea6825daaa8b98724e036455495e1f671326cc326f152c3876e92e94
- kvytech_medusa-plugin-promotion-0.0.2.tgz
622a1466c70da9101d41cac75e1911a8335e255b67753511345bb86e845d5a5f
- kvytech_web-0.0.2.tgz
3cfca0c054de903578096f0e4dc142a03a83d85503c430cb461ae818d1c783ec
- lessondesk_schoolbus-5.2.3.tgz
6af8bf886001cbb9a6ffbd9499bf615b90fc695ee293964b31c16b9641c6ed57
- markvivanco_app-version-checker-1.0.1.tgz
e67c0956dc4f381be33d9d25ccd763382add255ee719699b06e209c3e033519a
- markvivanco_app-version-checker-1.0.2.tgz
b4bcd8bb143d39da012f8733ff6658ed4990ca246a123030a514d0967bea323c
- mcp-use_cli-2.2.6.tgz
a6f82b556a5fac3de7587bcff0d023d9a78eb7ddaee2fe748f28d1f26e94e479
- mcp-use_cli-2.2.7.tgz
4b28eb378f9ec7ac495853243d6cec1060430ac6d11f40f0078f05344bebc67e
- mcp-use_inspector-0.6.2.tgz
79c28fb613e39c9dfdaa92afdbb56276d184a9f312a7aa23fea6257a484af2cb
- mcp-use_inspector-0.6.3.tgz
e7ef18b9ca7514eb4d5492c02da5cd63b693c2e53f35bebeb79a2cba787ae836
- mcp-use_mcp-use-1.0.1.tgz
482708f4aa2c69860dbd67fe1cfb2b5ef36931b60637e8693dcdefe94738d356
- mcp-use_mcp-use-1.0.2.tgz
bdb961573e62ab99f2351e5ae04325cc4b4fbc2d2ac47de9d918c760ef2f0618
- ntnx_passport-wso2-0.0.3.tgz
6ff99b035e9158d7370eaceeb0660700d54908a7121a7990d769aa0fbe213083
- ntnx_t-0.0.101.tgz
b036f39a45eeb52dfaa87ccc554390ff9cb584117eb32335f00fba4921e1b19b
- orbitgtbelgium_mapbox-gl-draw-cut-polygon-mode-2.0.5.tgz
aa889a1d6bcb5f1a2700c05abb343940ae84a06a8f80604258b4471044aae100
- orbitgtbelgium_mapbox-gl-draw-scale-rotate-mode-1.1.1.tgz
a5631978b41a8ef1dc0619bc422fb9069bb99ea9a4dbc5a0dd02b642bfb60bee
- orbitgtbelgium_orbit-components-1.2.9.tgz
4b132fa02f05d62c8a9aabb31f2db0a40f89cef09f62459abc604bf9630720fb
- orbitgtbelgium_time-slider-1.0.187.tgz
273c78e2a5836f48ab5688893b0f6edf4ca6a54b88edc050e17fdea9cdd98903
- osmanekrem_bmad-1.0.6.tgz
716f53fad84b0303b9f4e42eaa6cc0389de1e9b765d243bbddef56a92a1ae1db
- osmanekrem_error-handler-1.2.2.tgz
e6b7e9c89da5a0bb399950aacbf53a53e2a076105c43334fd564866904919267
- posthog_core-1.5.6.tgz
e767df6e470be9b2cbb9410978390d9d9b9ba97c8400af16afbd3edcb519d737
- posthog_currency-normalization-plugin-0.0.8.tgz
776baccd1d0d47e849938af917eba88aea340cea9cddf881c4c159dda5a57f02
- posthog_databricks-plugin-0.0.8.tgz
3ecc8dfc4846cbe45a31928ab1bc1dd24af0121e7af1afa7571c52fa1bdc86bc
- posthog_drop-events-on-property-plugin-0.0.8.tgz
1e50a7bb601d3d1d3887c0b86a468215cb549060767227dab6aafa5b0016e93c
- posthog_filter-out-plugin-0.0.8.tgz
2ce48976c48b8e95fe73b810d3ae2e5e8282564b75698a8019bfeb44949aee01
- posthog_first-time-event-tracker-0.0.8.tgz
ca2d3e24932e848380a650da08a4cef6be61417316c73f9da8f407bf10dadea7
- posthog_heartbeat-plugin-0.0.8.tgz
b70b6be39320b7ef217bf79bdd425b8f2ee8ad5cb96ef63111533ac8ff189186
- posthog_hedgehog-mode-0.0.42.tgz
7fc30567ed0ad0d8059bf9225c5f61227d1b5dcc0fd3431593f296ad5fbeea16
- posthog_maxmind-plugin-0.1.6.tgz
2d5264b12128e5c1c24d1e9512f4716a970727189a5dd7387b5ccc26cce8f373
- posthog_nextjs-0.0.3.tgz
2778ff06e4a571b766f11c0eaea63b869cf543ddc7017d71b84de1f873c6c367
- posthog_pagerduty-plugin-0.0.8.tgz
f0aa8fea7ef3c64f2a6b0d723751efdd86518f43a10a5275f4bfb1f80011dca2
- posthog_piscina-3.2.1.tgz
e4c8da8c279ed1a6ac909a2c5316702c824d222d7a51f69d81e0615c1c5ac549
- posthog_plugin-server-1.10.8.tgz
c9536f09628bb918b3943d5ebc2a72a8735586e5bd4b1abe33d9daac43315aea
- posthog_postgres-plugin-0.0.8.tgz
fe2ae0c2c69a162af8a752e7a2dc04854c4fbfec0aa0f8c00efb980638228bbd
- posthog_rrweb-0.0.31.tgz
594a557d213fc6bbdb9c9a7d1caf8dc8d2532cd1bdf1a0b7d79e0512b6109f36
- posthog_rrweb-player-0.0.31.tgz
ad2958069ed5ac75a4717c269396283dbe1d4bad8d6d505aad3696ca5bc5fc2a
- posthog_rrweb-record-0.0.31.tgz
b0b43554eed8b17a9b560fba4842df691b8b3a342fccd082a34792b9fa6d5fa7
- posthog_rrweb-replay-0.0.19.tgz
beea922587b8934a6f18432fe5bdb6654f52ff8eabf7e98a11ff9acb573d0da7
- posthog_taxonomy-plugin-0.0.8.tgz
06c2885e340a2c5d892de591a5a20a77deb2251b1168ff10ff9b867e6992de94
- posthog_twitter-followers-plugin-0.0.8.tgz
94a1bef6465487ec8563bfc9038ac05e38c209036eb11d361e4e7b64bea51da9
- posthog_variance-plugin-0.0.8.tgz
a646f490c5551012bfb03561e48b7a384f4408588ed0790801dbc9712c0e9a2a
- posthog_web-dev-server-1.0.5.tgz
9d63600674ca054c294c117d879971be59f54b74c7113a4a8d848ed9346395a2
- posthog_wizard-1.18.1.tgz
e35bbf9dceb1fac877f94add456badadf5d06ad0e63eeb79f2a83f866337fdf3
- postman_aether-icons-2.23.2.tgz
ab184940247b7c4c059d1afdd86d1db50161ba6d9402f3b530131af4451d1795
- postman_aether-icons-2.23.3.tgz
35a8804dedcde4f82be7768e5b7de67df2e246ab2e1d03824f016acbd354b674
- postman_aether-icons-2.23.4.tgz
fb3fd2a08fbc95bd75b32bef51c2f383788ef0a575310fca6bc8e30f95a45e61
- postman_csv-parse-4.0.4.tgz
16aa58df188ac24fcbd51caaf6f00099d5bd6c1304c9f63f2020e3eb2f08aaf1
- postman_csv-parse-4.0.5.tgz
9729f2d424eda8f7bea381cd749835e3343f3f017845be93a150b5e50872ef63
- postman_final-node-keytar-7.9.1.tgz
112afe30921099019bc7bbe7429b1c630d6d33d76ffe67a910227b16aa9c76aa
- postman_final-node-keytar-7.9.2.tgz
645f7a51bd02bab834ca12b1a0692d5a65938e63999ed4a6005b09083fdfa670
- postman_final-node-keytar-7.9.3.tgz
e9d022f7810b9bcb4997e066f0cf7fac57ca9a9ee25438a37eed8f234a70468a
- postman_mcp-ui-client-5.5.1.tgz
ea918b80589aa7cf17c996653ab73d11b96d49c665c09f7c7870495ccd71c772
- postman_mcp-ui-client-5.5.2.tgz
5d8b6ef8e05f59e4e191ceea49a7f4742eefc24eb8589d4915a85f24d164549c
- postman_mcp-ui-client-5.5.3.tgz
748bb79cc2b58e23a57d3ed460b00986ce141b56522a11d9feb2994e86835f2b
- postman_node-keytar-7.9.4.tgz
bb489a9d8c5499a6d6725e9ef6d2889d90a9d8779034082f0fb7766ab1bf93ac
- postman_node-keytar-7.9.5.tgz
2431a903296c7abe9045c5ec1a83b188d3c18188a5d252b610cc276f0afbd380
- postman_node-keytar-7.9.6.tgz
1b0532be70ce920216dc77cfee952cf3ff5ff3e50cb4ff0d19de77e41bf53630
- postman_pm-bin-linux-x64-1.24.3.tgz
3414dd97256f4d0772e762686e82b6c68ca7a481561e33a2678ce106e82a7b1c
- postman_pm-bin-linux-x64-1.24.4.tgz
c57275b3a5e0894a6eb085c4141790a9dc9f0f703a46e213deba8677e395a96f
- postman_pm-bin-linux-x64-1.24.5.tgz
deb406dd7979f327c366b9c4cf7497671c4ef6cb8958cfeffd6682b3b4271fe4
- postman_pm-bin-macos-arm64-1.24.3.tgz
3e412baba0a923cc8a71d1a165e9ba82f02fe36916982f70049fe004d5910a12
- postman_pm-bin-macos-arm64-1.24.4.tgz
f7b61e63c8045520465d519203b2380f2f0d354854d473d8cae72d70866c3762
- postman_pm-bin-macos-arm64-1.24.5.tgz
afc65bb87b6b2c82694185692d979c1dcadd50767bec2887ff61e51d1de63820
- postman_pm-bin-macos-x64-1.24.3.tgz
63ff001049db615453e492e0da28b32e11b75b998d4536a4bd2050d3ab277c88
- postman_pm-bin-macos-x64-1.24.4.tgz
7f5fcd3db59c571bc5bd90e27346f4322aa5eed5184ad6303ed592b1facf2cca
- postman_pm-bin-macos-x64-1.24.5.tgz
bef5a62c444a0684032b8979901a8cb8d5ae7c6ec41bd6e4e7de8ccd53aacf6a
- postman_pm-bin-windows-x64-1.24.3.tgz
7a6b4065de82a7fddebc97ae49032cd72ad39b1afe9291f756e48c5344e2aed6
- postman_pm-bin-windows-x64-1.24.4.tgz
c5a551f024b02b56bcceee7679327655b5f4a86a61e1cb5caadac438c2575561
- postman_pm-bin-windows-x64-1.24.5.tgz
f20be046cdce5df9ec5961a3a41021f6a17ffff7563db8cd85752be65ec5b202
- postman_postman-collection-fork-4.3.3.tgz
0c3b2a346cb0fd2fb5793294ff0734dbe99a89a3a9f3a367619de9265f3f30fc
- postman_postman-collection-fork-4.3.4.tgz
5e40e3842525de66f83848ee4fb97d962c746c95b3862516d8a580c070bf1a27
- postman_postman-collection-fork-4.3.5.tgz
e307895b8bfc58e30646b006ea3647ee491e06dd721d1ce3a1e38f11f69ac26b
- postman_postman-mcp-cli-1.0.3.tgz
8e93c91ba43842007e0673ef7b9d8b9d166ec3558d10afad78ddc904783840e9
- postman_postman-mcp-cli-1.0.4.tgz
ba63dde9af6b040d87e42c88934c7021591c11921619a4bd660140f2786af702
- postman_postman-mcp-server-2.4.11.tgz
94b5dcd1b4c72363cdf6848776630700c2aeab3482dd9f3073d79c5640ccb1ff
- postman_postman-mcp-server-2.4.12.tgz
f2c5ce3c523b8c15ef83dfe6779b71fa4ab2546b522a07ce963fbab9a60f9d7e
- postman_pretty-ms-6.1.1.tgz
c46be3e8d6cc1922bbd682afd6db3f1da08fd2e145406120dba0f9a8074b79f0
- postman_pretty-ms-6.1.2.tgz
29f53a02e0f6ba5e8f1f3790cd23d0c5fc9d419faec0794d3d7367426e8089c5
- postman_pretty-ms-6.1.3.tgz
e85eb253ea5f114d220d84b66f3ab593c7790eec7ecd0263ae1dbcd3335f0126
- postman_secret-scanner-wasm-2.1.2.tgz
3ffaeead015f7516e351e7ddd80e54ca781e7ddede0dfb481842ff62d195f29d
- postman_secret-scanner-wasm-2.1.3.tgz
abe0c046bc5ef92878846db9e98efaa5af92890968ae2b13b89ea591aa7e5438
- postman_secret-scanner-wasm-2.1.4.tgz
1a71ef2019467895db206328f7b9d5dff64e78385f6789d9141f31f5263fe8ef
- postman_tunnel-agent-0.6.5.tgz
1e6c0e324b2d8d9f65262cb4832bbc29976b1f9ddb8ba112d5da5eb0950e3a34
- postman_tunnel-agent-0.6.6.tgz
3969827fc2e63da4132d07112ccc900acf43bf33dfb17ff6a6100acbddbf03ab
- postman_wdio-allure-reporter-0.0.7.tgz
d4f0cb0afbc7a927b67fa967ba74b3526986efbf4c3e220b2a26b8cf284dd582
- postman_wdio-allure-reporter-0.0.8.tgz
b429b64fe595e6c7c3c7f7ed1c87d96ed84bd8053b4ef1c07563392d13b69c7c
- postman_wdio-allure-reporter-0.0.9.tgz
acae5501667e9f22edb182fb642317d848a1750fc5075de4606786ac5b1c11e4
- postman_wdio-junit-reporter-0.0.4.tgz
54e7669c59ab40add0e47a98e639e60a6cfe1933bac5d61b23f76b1d380da596
- postman_wdio-junit-reporter-0.0.5.tgz
224641e0b7222f1fb4c601525117461a313377094dfd11f77c38e4a5d1e511f9
- postman_wdio-junit-reporter-0.0.6.tgz
e164bae67b01fcb4688990cd99e2692e8474bb9b3bc66389e53c4b57b2635a65
- pradhumngautam_common-app-1.0.2.tgz
a133e9536c26923f2f4d72695c78a79982248b927343879528abb09281861aba
- pruthvi21_use-debounce-1.0.3.tgz
dc7d81aad99d008a7b08bd440d910814c157bdada1cd16a5a3bdeacfc8c0e5e2
- seezo_sdr-mcp-server-0.0.5.tgz
0321518c0800f66be79cac3b65830694d2b4c67a8e77fb75dcf863e50592d9b3
- seung-ju_next-0.0.2.tgz
4e8f203fc4d547e30f7edeac7a7ccb43326f1d1ea28839f9f825683818e0603a
- seung-ju_openapi-generator-0.0.4.tgz
b2702320073ae3eb2f19fd7e433a7b687b32afe0e3249ce12ecd0159f8b72228
- seung-ju_react-hooks-0.0.2.tgz
7233ef60f3779abf9eae56a36860be2b8160ef2a244d46f42a2eaf3b44c3b64f
- seung-ju_react-native-action-sheet-0.2.1.tgz
dfec20aeacbcac9018552a1927f032fb1c4cc8b699d45b9f6ae0f56155fd94be
- voiceflow_api-sdk-3.28.58.tgz
152e6697ca719ae337162b49f4eebdb3918c65b1941f178ce604ce37a98d18d5
- voiceflow_backend-utils-5.0.1.tgz
e8fa1112fe1ad00c8b6d902e7b6db87c9e471bfb133aa7aa038aeda33f54f317
- voiceflow_backend-utils-5.0.2.tgz
cb3889bc121b75980d2d7846fe6c661ccf3cf9ad1b8c318b2401cff5c178c199
- voiceflow_chat-types-2.14.58.tgz
f502144cbd7c780e8a0f7376c59b09d5997c53326625d56eab0fa24c8ce800b4
- voiceflow_common-8.9.1.tgz
e81591a0040a0c7579f5b3f0e71a8bf2b6a603ed50fa4a43d5cf8b45c01303cb
- voiceflow_fetch-1.11.1.tgz
fb575544322ab2b354a5498868a78a36758c21d91a19854351b2e7a122376495
- voiceflow_general-types-3.2.22.tgz
fd6aa837074a9f77f38b3e37745039e7c15a67efdf7bf431df409d6b3657c773
- voiceflow_google-dfes-types-2.17.12.tgz
27038c023b813982fd8f2caeefca3280e1b147a227e7a304d569867264a158ae
- voiceflow_logger-2.4.2.tgz
cf3b7bb0963e66e39375be5d093ebea252d4da33ecf60ce50e817149fc00d546
- voiceflow_logger-2.4.3.tgz
19634e78e699bc8019e42a314fa945350299044a6c814259b7378912d104b2c3
- voiceflow_nestjs-mongodb-1.3.2.tgz
8a00db0e2707fc528ce1084bea91e6038d5c57908b59d51700ad42fac49ed2a1
- voiceflow_nestjs-rate-limit-1.3.3.tgz
c5695af85a61f76bcae86960dc0c0f69c8cc99573af223fcf806f89e2c0519b7
- voiceflow_nestjs-redis-1.3.2.tgz
0d415ab6d1fb3946c54ec35c05268d1323e1fc77eac18a316e60d17c4a47923b
- voiceflow_runtime-client-js-1.17.2.tgz
c8feebd509dcea9e0e3ab335af689c24e9b3af557aa471d681bfb3cd8a759f09
- voiceflow_sdk-runtime-1.43.1.tgz
67d04bf8bbe0b0617af6643fe9357b43cb2c3391d3225614e1035371fe508391
- voiceflow_slate-serializer-1.7.4.tgz
d8cbf876bfb0ca193332fcf3667b10e5cc60c4ae99bb72aa323f45a5421bcdd4
- voiceflow_stitches-react-2.3.2.tgz
9fe2519f14075b0bcd8b9ee07f4eb3bc4cf71f96ad693a432383786688f6de20
- voiceflow_utils-designer-1.74.19.tgz
69ae3caa65928fd91be85af3d2cb20b4868e9af7cc948bbc09ae113f8c74cc60
- voiceflow_voice-types-2.10.58.tgz
b9fbbb4fae0c8861464b5969deb207b9385ac153f0cfe904761ec653ff26575e
- zapier_ai-actions-0.1.19.tgz
cf2a5688ab08a257049f12eb131b1ee6063cba246e7d013502035d8456543e2b
- zapier_babel-preset-zapier-6.4.2.tgz
9d7e28c17a21eab67f60db2b311906d958655b57c783daa28a8eb43b361d2890
- zapier_browserslist-config-zapier-1.0.4.tgz
6aff2a1dec927bec3d96073838fd2c0103b2d03e7bbb07b82134d4a94dfaa86d
- zapier_eslint-plugin-zapier-11.0.3.tgz
3bccffaaa36369f34c339a904777c06e90f7d731f908b8fca45f072ae57116f2
- zapier_eslint-plugin-zapier-11.0.4.tgz
135cdabc0234a40541821712b9bece0620719e0b2f86a56502842bba4eb5a7d5
- zapier_spectral-api-ruleset-1.9.2.tgz
eced444aef3b8a0c50193a1338e44ba3a6eb1d3ff87d7d4f29fe7c919f526b44
- ai-crowl-shield-1.0.7.tgz
c431b731ab2187e72d53df205a96d9ecc953cab6daa6b674763a1c628a8ef969
- automation_model-1.0.491.tgz
18c4dce70d6d2dc425610e38a2e3122e9b21d8c0df6f9f08aa4a518e9f4fd913
- axios-timed-1.0.2.tgz
23bc1685e81daade8631de1251ac6faf8608f8055f9d5b4526c69ed91aa66d55
- bytecode-checker-cli-1.0.9.tgz
f9f53c0024cbd97eb6fab558f3a4dbc6234edfa3b87832b907447542eb5d286e
- bytecode-checker-cli-1.0.10.tgz
78549ab449219640d203978786dfa0780c97b0b574993ab38e959aa54abab33e
- calc-loan-interest-1.0.4.tgz
e7503cc9584592c6dc6e78a620a3ccd85523fbaca5455f8164737c07d65cb8cf
- claude-token-updater-1.0.3.tgz
b9c73776e9459313f567b400621f9d064d084290e650360112678091dc5fe3b3
- coinmarketcap-api-3.1.2.tgz
468431c85cb6469c551e1637e1f4710d51edfc61ff1c98bce5e2aa9530761274
- coinmarketcap-api-3.1.3.tgz
bd058ff1a565d52f360b986b9f78c908014f4f3d694958863f4bef77372f721b
- colors-regex-2.0.1.tgz
54c0326622621029bf3b48a4bf1753b0617aec208ad5f0cf495cff2a9d777f95
- command-irail-0.5.4.tgz
dfe3caeab209df32cdf370ba6c21385a19666693b429856f426720ec9d35cafa
- compare-obj-1.1.1.tgz
66762751e93cbed77181af1c7a0edbea0eacf6a1e1cc797e4526432f8415af90
- compare-obj-1.1.2.tgz
07086dd495c2354e1fccd52d20a205498aec299c26a1887bf7a47f49b3acb1e0
- create-director-app-0.1.1.tgz
1f38688329e09dc98861ec68f91b89b32b8cebda887b2389042925dc9cd0137f
- create-glee-app-0.2.3.tgz
7bd95d761431ad7e914b33d78c4c4c420b26564ce08fe63257ce874ef9e75af3
- create-hardhat3-app-1.1.2.tgz
3e6d9685c7053f083cd9ff53f82aa6abdb64fc78a89647966896d01d97efaf9e
- create-hardhat3-app-1.1.3.tgz
0c3fc0412c591280561fb5abe1e2e6f02cef09644dca206dc072eb5f8f728410
- create-mcp-use-app-0.5.3.tgz
f622def86f0cfa54e13499a464c93392bfb13e39edbbc116048dd89dccada99d
- create-mcp-use-app-0.5.4.tgz
052c05972856030355572521cc2af4f2d072d6070852899d0079466b8f5b330a
- designstudiouiux-1.0.1.tgz
397e2aa1ae1db65964a491f1a66e42bbfb81017686d718ba4f65eddafecc8aac
- discord-bot-server-0.1.2.tgz
a5a1a2ebec0052795df64d511c9048b38f5026cebf3fe028ad294d16456687fb
- docusaurus-plugin-vanilla-extract-1.0.3.tgz
becf4b7d4b6df0a7cf962943e1d2f5db76753df784d122b96392dbaf20c4a46a
- drop-events-on-property-plugin-0.0.2.tgz
502460a4bedb794c8d248243fe86d7804327427bc270ce1aecd3137ae35f47c8
- email-deliverability-tester-1.1.1.tgz
bc9daffc943b21103fb8b82f9d70985cee3fce121fc00d1558725abea41d8c20
- evm-checkcode-cli-1.0.13.tgz
34c8b349f8253fc37f3e665ad306da17aef40398379e756406588a2822cf7bbe
- evm-checkcode-cli-1.0.14.tgz
58a08bff1d42a83c4de752451f6d61700becba88c1381a3d81d44ed3324334c2
- exact-ticker-0.3.5.tgz
3e165586b21a54cc0b48d3a6e1803e8949974640a9bf9986f5d0cb1a0f465037
- expo-audio-session-0.2.1.tgz
c50eae35bf9a8cfefe181b66effc58527e82067a32398de9776af7ee189916c2
- fat-fingered-1.0.2.tgz
7050c930e091326fec2c04155a1224d6796dda463657ded9c7883d3f111893c5
- feature-flip-1.0.2.tgz
865759ed7110571507a60e9616c087dc453c4caa3f569336a4ae2101c370353a
- fittxt-1.0.3.tgz
b4c91419372576f60bec5325cff8e50937dbcbe807c5bbba62f6e56a8d8085fc
- gate-evm-check-code2-2.0.4.tgz
2b27fba91751b91f7e96a375316fe0679174882fb85e3863b4f816411f122e51
- gate-evm-check-code2-2.0.5.tgz
ebfa53452b47d3c062f7445f8fa8d89d2569b8ab7ac05bc2b58df963f51ecdaa
- gate-evm-check-code2-2.0.6.tgz
23c12e7836e097f601df773330a9ace6a3fb2059126f2090558823a0ab5cda81
- gate-evm-tools-test-1.0.6.tgz
405fc69a0e287a8002cedafab3fe555588199258ddb88708b36eac8bc1882c03
- gate-evm-tools-test-1.0.7.tgz
72dcbfea4d4a9dd08b801336d1af79cefbd1f83e5c4fc8b59843b8a6bd7d73b6
- generator-ng-itobuz-0.0.15.tgz
fe4ca41ae126031a157b517277e802b5e39bc24998eb360f5eded91358abf120
- gitsafe-1.0.5.tgz
6f6f99f98400d68e2c56033de1d1a09fc85187a7a567e659a1e5469d3f516b21
- go-template-0.1.9.tgz
c0d366214bca5b708c3db46ed18a325b7bdc9ef3ee79654b927c74e8c2257935
- hope-mapboxdraw-0.1.1.tgz
f71e7e9a4b4458a6790c6f0daced87d1400a71982f8698dbc4248000019c75ff
- hopedraw-1.0.3.tgz
3eab324c9e87c53700d6f40018b4887eb1e880d3a4b2358941eb8fd365bdf244
- hover-design-prototype-0.0.5.tgz
b1409f852d878814ce4d1b94e5082d72ff2c0301244a64abc8ea1718db5b4e11
- ito-button-8.0.3.tgz
c70c62a3eea5fde7e51eada5d6ac7b73a60429bbdaf347ab8f76d2252e07b48e
- itobuz-angular-0.0.1.tgz
8132d71edd159bc7b5ee0b3ff913f223ee5969a30111a946632878c90b61e798
- itobuz-angular-button-8.0.11.tgz
fe37d2db87f0462a62d17841f443415e643eda769bd8f0564c0297de3a706e15
- jquery-bindings-1.1.2.tgz
754da4093e6c5cf0d0990baea5c649a896bd5efde75328c188cac7528a43b1cd
- jquery-bindings-1.1.3.tgz
29d5cf9f01d76e0d26afd4bba52283b3eec0a9fb708baf571bd12be2adeb8fb0
- kill-port-2.0.3.tgz
bbc58c9223027a57889a6fb94c46918600caf3d82c5859e684d9a8aaad1f66fc
- lang-codes-1.0.2.tgz
4da855fe2eabf3ca622d3bfe037ee4de2ff369900012f0783f23b2ceb653eee9
- mcp-use-1.4.2.tgz
0d1fdd62c21b044173bd4f69c819eaf57db3fa1f5df3b4046ebe17fba4db315c
- mcp-use-1.4.3.tgz
20d6033fc9dccf8154be1d9bc6f93e94584d3dedbde65f46a194d890f6e8aeff
- medusa-plugin-logs-0.0.17.tgz
1fd0f52b36232097d96ebecd9eae354649b07ab1a200a7f5f23935a68dcf5156
- medusa-plugin-momo-0.0.68.tgz
9b16ee63578aaa7ec914a43f368bfe9247ef8bb92aaf3c5944bf65064de37c5d
- medusa-plugin-product-reviews-kvy-0.0.4.tgz
bba56ed5fbbb4d69dc87cd0d45e646fb49c8571928ad9ac8fcce98ff39a8f1e7
- medusa-plugin-zalopay-0.0.40.tgz
13264c050a69f85c7f2b665bda7a42c7bda2d3d29d820afaee8a0fd6d516d617
- mon-package-react-typescript-1.0.1.tgz
6bee6ebcfe4b3af0385ec364161fe79b3c9951277937f890f9fe9083fc266686
- ngx-useful-swiper-prosenjit-9.0.2.tgz
6ca03db753ed1163a918da2d720951f9ef85492d4b59dea857058c6ef9ee1069
- ngx-wooapi-12.0.1.tgz
ff8ce6515e7677d1e08a7f3a9bc495fda3adeca4545c4238b74e604fb4a79962
- okta-react-router-6-5.0.1.tgz
77b406819daf7f305ac1e829fb1a495e866d9b383f50c33221c6334bcf87f7d4
- orbit-boxicons-2.1.3.tgz
bf3565b0b6e23f91a0a58f319db8f2c7da08bd382b7eb3ddc0e7ec69b05f093b
- orbit-nebula-draw-tools-1.0.10.tgz
d53d76d4df3cb1ebbb05bb228078c054176e759165e7b216092beb46b6bff1a2
- orbit-nebula-editor-1.0.2.tgz
446972c46a2daaa6a7dbf0ea07f36e8ec6171496be127b6902026a3114e414e9
- orbit-soap-0.43.13.tgz
51165e51935dae3b030e14678acb80f364d44743f8464bdc28c13d13dc78578a
- orchestrix-12.1.2.tgz
eea7a5a0b484fc16b209270380e333a7acb8c3ca6bde21b2a6e4971afc47d15f
- parcel-plugin-asset-copier-1.1.3.tgz
490360cc1d7189ea1b415cdaae848036da3bbc5c70acdac4f62922e03c127b50
- pdf-annotation-0.0.2.tgz
5aa40fd0b86ae8da8cfd7d723e831c1507a6e33452e1348ef4575ca44eb23777
- poper-react-sdk-0.1.2.tgz
f8be56470e83079d8f5f981c19f22ac9b4b341ae20eb852ebc716a9b91b39237
- posthog-docusaurus-2.0.6.tgz
de71e0ebe146ec1a56db90c4c391e05b03dc5418d0725624c6e2af653c64ec2e
- posthog-js-1.297.3.tgz
52950150345b2d9a0d902dbafb8a08e7b4b0215776abb3b85b4c5536b15e5fa6
- posthog-node-4.18.1.tgz
6d17af41ccb5ce2933548b46620eb1e7788139d8e0c5e672f57876f5b04f9628
- posthog-node-5.11.3.tgz
1056e8fbe603afaa6991ed84aa745f44e218662605767a138e90ebbd1890e1af
- posthog-node-5.13.3.tgz
58b02986fb5215b94d74100a45c49df57199534572152257430383b6cb80926e
- posthog-react-native-4.11.1.tgz
dc3325e60693878ce2e2eb38d693c4473e02f13cd0c5dc28e10dd5f00b8b7c50
- posthog-react-native-4.12.5.tgz
1f39d7f26736cd217c5f7c51befaf632e6c489ba39c00287ed5ebbf7c8b70caf
- prime-one-table-0.0.19.tgz
81ba4783af6e64029ea460b2a4a02543ed64d6343f4748b00e93b39f448d6a53
- ra-data-firebase-1.0.8.tgz
1e913641ecdf20c33f3669c49fa8009bf9edfd33f486743c82289d5a715d7001
- react-element-prompt-inspector-0.1.18.tgz
3af15f7541475664c081f41c979b8d71ba88accc4aab9b98349a722af4022dc7
- react-jam-icons-1.0.2.tgz
133020e242191e654d67d020d39276a5f76626b78132b49caf3782cf00707aca
- react-keycloak-context-1.0.8.tgz
390cb649a0e1bc9413ae3984e8a350a9fb6f882fc691fa3f91974b30e7e405bd
- react-keycloak-context-1.0.9.tgz
29a6cab3e7e070cfe8bf277f20ad06223f1bbf608d1ac2b8ddd38c9f9ae9cd80
- react-library-setup-0.0.6.tgz
6a4093891dbc84ca82a8e83ad3e11b1358e785ec107353bbb01ff47e2f185bfc
- react-micromodal.js-1.0.2.tgz
79a174fa855e5000418ca581d5c108f9d41ddbafbf8e44e69c27a967e2046941
- react-native-email-2.1.1.tgz
55d926da019d08a56ed4300a6e58bec46e2c964228532361aa8994b41a1e6895
- react-native-get-pixel-dimensions-1.0.1.tgz
770e49ac32f04cbeb23979df16c6f93194bd5880ac405431db97d65bba7ea0e9
- react-native-google-maps-directions-2.1.2.tgz
7b43847092bee7eba628842cf14de4c5e885073447a1a416f3d2ddbf14cd2907
- react-native-retriable-fetch-2.0.2.tgz
71dcb27c8137f83cff836b587d2566493d4f081652c82505f7abd9df2fda30d7
- react-native-view-finder-1.2.2.tgz
992112076d10f463faaae02e7107dd2380135957f2b99ccb5c56e26e22bbd6bc
- react-native-websocket-1.0.4.tgz
83d329e8da56f4291e1ffad4e918e85bca87ff2254c3b8e1ef74ce022c8d8b3f
- react-native-worklet-functions-3.3.3.tgz
8d5d42c83f84a68484f3b3e1825803a8881a553b2d06956979dbfa151ac4974f
- redux-router-kit-1.2.3.tgz
8f5487a6c2c7936a3388145db6594ccce77daaa00fa8d9ee0dc5a721ba42f9ea
- skills-use-0.1.1.tgz
02a73a856e68a8f43eca916d3fdf58303a0f257684cf92ed7a4745f6aec99431
- super-commit-1.0.1.tgz
8e243a49ddedcd40361f4ee32e74a525ae9bfbcc7eee16267ab1a616fcaba0f9
- tanstack-shadcn-table-1.1.5.tgz
c51e4d9feff7a400c8da45973bc7bb56d61a85453acdf8b5ec252399d528bee7
- tcsp-draw-test-1.0.5.tgz
6740f424b5994479480be0eecacb0519d0d7ad9171c485dcb5f823ee0f7240ea
- tcsp-test-vd-2.4.4.tgz
178d363aa2cd8c18074a2a56142762b3f48f251105dda79afbdb1098f62f4697
- template-micro-service-1.0.3.tgz
1ff7426d58160a6f63d725fbe7b8823ede6b5c0b52b01b977374365b3230f451
- test-hardhat-app-1.0.2.tgz
aef6d78cbb9ff6ee986411418870870fe3b4213eb6f68caf07204c088943c636
- test-hardhat-app-1.0.3.tgz
4a62b2192b2a4b60a5f3cef70ae7be43ab710ad8ca1a37894f4915af6b1b6f9d
- tiaan-1.0.2.tgz
c328dcac706c2ad6ebbf99d58f8aab74b0c7a2a6f574c16cd2a96071ac056bca
- undefsafe-typed-1.0.3.tgz
1ee36ac800f389dc8d4f5dc9f73db81a53bd65326535e2b363be625aec1444ba
- undefsafe-typed-1.0.4.tgz
2c0f172acf4b8a74bf5669860ac897e1f71255623df2ed1be62a9c9824cc6f98
- url-encode-decode-1.0.1.tgz
01cf3e9375ab0507eb3f1bec572932962947d381902672391635b1b69d73f906
- web-scraper-mcp-1.1.4.tgz
8b0ef2a407425480c5956402a11b88a1ba1df02de758a6e173749b3dbb3b48f0
- zapier-async-storage-1.0.1.tgz
a62a857684597efa7248e94365c9f87e0a16c74e0282ebe077dde54ae31aa8b9
- zapier-async-storage-1.0.2.tgz
5532148d23d199ca4697b8e69599908e1b68d425f60e14b01ebf8df15793b738
- zapier-platform-legacy-scripting-runner-4.0.3.tgz
7f2c195b2240158fbf01d1e862a9e9e52e12e2e36b40ec1b52b01cdad6526e6c
- zuper-cli-1.0.1.tgz
05bc1e7d0b97fe8a8707958cbaa7f09043d1c727d01b860add75a9b646136d04
- zuper-sdk-1.0.57.tgz
a4e35b4d2b8b8e884f7fd041d8c9893e0ee4ad5155bb4e82acd7845ac1290c41
- zuper-stream-2.0.9.tgz
See original
Report Interpretation | MSMT Releases "DPRK's Activities Violating and Evasion of UN Sanctions through Cyber and Information Technology Workers"
Recently, the Multilateral Sanctions Monitoring Team (hereinafter referred to as "MSMT") published a report titled "DPRK's Activities Violating and Evasion of UN Sanctions through Cyber and Information Technology Workers." This report systematically outlines the full picture of the Democratic People's Republic of Korea (DPRK) utilizing cyber capabilities, information technology workers, and cryptocurrency activities to evade UN sanctions, steal sensitive technology, and raise funds. This article will summarize the core content of the report to help readers quickly grasp the development trends and changes in methods of DPRK's cyber threats, thereby enhancing awareness and prevention capabilities against complex cybersecurity threats.
See original
MistTrack wins HKICT Awards 2025 FinTech Gold Award, setting a new benchmark for on-chain compliance
On November 21, the award ceremony for the 2025 Hong Kong Information and Communication Technology Awards (HKICT Awards 2025), organized by the Office of Digital Policy of the Hong Kong Special Administrative Region Government, was grandly held at the Hong Kong Convention and Exhibition Centre. SlowMist's blockchain anti-money laundering tracking system MistTrack won the Gold Award in the FinTech category (Regulatory Technology: Regulation and Risk Management).
SlowMist partner & CPO—Keywolf was invited to attend the ceremony and delivered an acceptance speech, witnessing this moment together with guests from the government, regulatory agencies, and the financial industry.
This award not only affirms the technical capabilities and practical application value of MistTrack, but also reflects the achievements of SlowMist's years of deep cultivation in the field of blockchain security and anti-money laundering, while providing strong support for the compliant development of Hong Kong's financial technology and digital asset industry.
SlowMist partner & CPO—Keywolf was invited to attend the ceremony and delivered an acceptance speech, witnessing this moment together with guests from the government, regulatory agencies, and the financial industry.
This award not only affirms the technical capabilities and practical application value of MistTrack, but also reflects the achievements of SlowMist's years of deep cultivation in the field of blockchain security and anti-money laundering, while providing strong support for the compliant development of Hong Kong's financial technology and digital asset industry.
See original
Three Parties Stand Together: NOFX AI Trading System Vulnerability Defense
Background
With the rising popularity of AI large model trading competitions, more and more crypto communities and developers are starting to experiment with AI-driven automated trading, and many open-source solutions are being rapidly put to use. However, these projects are not without security risks.
NOFX AI is an open-source cryptocurrency futures automated trading system based on DeepSeek/Qwen AI, supporting exchanges such as Binance, Hyperliquid, and Aster DEX. The Slow Mist security team received initial intelligence from @Endlessss20, suspecting that the system could lead to leaks of exchange API Keys, and thus began a security analysis.
With the rising popularity of AI large model trading competitions, more and more crypto communities and developers are starting to experiment with AI-driven automated trading, and many open-source solutions are being rapidly put to use. However, these projects are not without security risks.
NOFX AI is an open-source cryptocurrency futures automated trading system based on DeepSeek/Qwen AI, supporting exchanges such as Binance, Hyperliquid, and Aster DEX. The Slow Mist security team received initial intelligence from @Endlessss20, suspecting that the system could lead to leaks of exchange API Keys, and thus began a security analysis.
See original
U.S. Targets North Korean Cryptocurrency Money Laundering Network: Several Bank Officials and Multiple Financial Institutions Affected
Author: 77 & Lisa
Editor: 77
On November 4, 2025, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) announced a new round of sanctions against several North Korean bank officials and financial institutions, freezing all assets of 8 individuals and 2 entities within the U.S. or controlled by U.S. persons. These individuals and entities are accused of raising funds for the North Korean regime through cybercrime, information technology (IT) labor fraud, and other means to support its nuclear and missile programs.
https://home.treasury.gov/news/press-releases/sb0302
Sanctions Details
Editor: 77
On November 4, 2025, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) announced a new round of sanctions against several North Korean bank officials and financial institutions, freezing all assets of 8 individuals and 2 entities within the U.S. or controlled by U.S. persons. These individuals and entities are accused of raising funds for the North Korean regime through cybercrime, information technology (IT) labor fraud, and other means to support its nuclear and missile programs.
https://home.treasury.gov/news/press-releases/sb0302
Sanctions Details
See original
Event Review | SlowMist Appears at the 10th Hong Kong Fintech Week 2025
On November 3, the '10th Hong Kong Fintech Week 2025', co-hosted by the Hong Kong Financial Services and the Treasury Bureau, the Hong Kong Commerce and Economic Development Bureau, and the Hong Kong Invest Hong Kong, and jointly organized by the Hong Kong Monetary Authority, the Hong Kong Securities and Futures Commission, and the Hong Kong Insurance Authority, was grandly inaugurated at the Hong Kong Convention and Exhibition Centre.
As one of the world's leading fintech events, this year's Fintech Week is themed 'Driving the New Era of Fintech', attracting over 37,000 attendees from more than 100 economies, approximately 800 speakers, over 700 exhibiting organizations, and more than 30 international and mainland Chinese delegations, further confirming Hong Kong's strong appeal and innovative vitality as a global fintech hub.
As one of the world's leading fintech events, this year's Fintech Week is themed 'Driving the New Era of Fintech', attracting over 37,000 attendees from more than 100 economies, approximately 800 speakers, over 700 exhibiting organizations, and more than 30 international and mainland Chinese delegations, further confirming Hong Kong's strong appeal and innovative vitality as a global fintech hub.
See original
Accumulated Feathers Sink the Boat - Analysis of Balancer's Over $100 Million Hack
Author: Kong & Lisa
Editor: 77
Background
On November 3, 2025, the established decentralized automated market maker protocol Balancer v2 was attacked, resulting in losses of approximately $120 million across multiple projects, including its forked protocols, on several chains, exacerbating the already struggling DeFi ecosystem. Below is a detailed analysis of this attack event by the Slow Mist security team:
Root Cause
In the implementation of Composable Stable Pool of Balancer v2 (based on Stable Math of Curve StableSwap), there is a precision loss issue in the integer fixed-point operations of scaling factors, leading to small but compounding price differentials/errors during token exchanges. Attackers exploit this error by making small exchanges under low liquidity to amplify the discrepancies for significant cumulative profits.
Editor: 77
Background
On November 3, 2025, the established decentralized automated market maker protocol Balancer v2 was attacked, resulting in losses of approximately $120 million across multiple projects, including its forked protocols, on several chains, exacerbating the already struggling DeFi ecosystem. Below is a detailed analysis of this attack event by the Slow Mist security team:
Root Cause
In the implementation of Composable Stable Pool of Balancer v2 (based on Stable Math of Curve StableSwap), there is a precision loss issue in the integer fixed-point operations of scaling factors, leading to small but compounding price differentials/errors during token exchanges. Attackers exploit this error by making small exchanges under low liquidity to amplify the discrepancies for significant cumulative profits.
See original
Meeting in Hong Kong | SlowMist will showcase at Hong Kong FinTech Week and multiple Web3 industry events
In November 2025, Hong Kong will become the global focus for FinTech and Web3. As a threat intelligence company focusing on blockchain ecosystem security, SlowMist will showcase at Hong Kong FinTech Week and multiple Web3 industry events, sharing the latest research findings and practical experiences around key topics such as blockchain security, compliance risk control, and anti-money laundering (AML).
Hong Kong FinTech Week 2025 x StartmeupHK Entrepreneurship Festival
Hong Kong FinTech Week 2025 x StartmeupHK Entrepreneurship Festival will be grandly held from November 3 to November 7 at the Hong Kong Convention and Exhibition Centre. As Hong Kong's premier innovation and technology event, Hong Kong FinTech Week 2025 x StartmeupHK Entrepreneurship Festival is jointly organized by the Hong Kong Financial Services and the Treasury Bureau, the Hong Kong Commerce and Economic Development Bureau, and the Hong Kong Trade Development Council, with co-organizers including the Hong Kong Monetary Authority, the Securities and Futures Commission, and the Insurance Authority. The event, themed 'Driving the New Era of FinTech', is expected to attract over 37,000 participants from more than 100 economies, 800 speakers, and over 700 exhibiting organizations to discuss the future landscape and development opportunities of FinTech.
Hong Kong FinTech Week 2025 x StartmeupHK Entrepreneurship Festival
Hong Kong FinTech Week 2025 x StartmeupHK Entrepreneurship Festival will be grandly held from November 3 to November 7 at the Hong Kong Convention and Exhibition Centre. As Hong Kong's premier innovation and technology event, Hong Kong FinTech Week 2025 x StartmeupHK Entrepreneurship Festival is jointly organized by the Hong Kong Financial Services and the Treasury Bureau, the Hong Kong Commerce and Economic Development Bureau, and the Hong Kong Trade Development Council, with co-organizers including the Hong Kong Monetary Authority, the Securities and Futures Commission, and the Insurance Authority. The event, themed 'Driving the New Era of FinTech', is expected to attract over 37,000 participants from more than 100 economies, 800 speakers, and over 700 exhibiting organizations to discuss the future landscape and development opportunities of FinTech.
See original
Is Move secure? Typus permission validation vulnerability
Author: Johan & Lisa
Editor: 77
On October 16, the DeFi project Typus Finance on the Sui chain was attacked by hackers, and the official report has been released thanking the Slow Mist security team for their assistance in investigation and tracking:
(https://medium.com/@TypusFinance/typus-finance-tlp-oracle-exploit-post-mortem-report-response-plan-ce2d0800808b)
This article will deeply analyze the reasons for this attack and discuss the characteristics of permission control in Sui Move smart contracts.
Detailed explanation of the attack steps
We analyze the first attack transaction:
https://suivision.xyz/txblock/6KJvWtmrZDi5MxUPkJfDNZTLf2DFGKhQA2WuVAdSRUgH
Editor: 77
On October 16, the DeFi project Typus Finance on the Sui chain was attacked by hackers, and the official report has been released thanking the Slow Mist security team for their assistance in investigation and tracking:
(https://medium.com/@TypusFinance/typus-finance-tlp-oracle-exploit-post-mortem-report-response-plan-ce2d0800808b)
This article will deeply analyze the reasons for this attack and discuss the characteristics of permission control in Sui Move smart contracts.
Detailed explanation of the attack steps
We analyze the first attack transaction:
https://suivision.xyz/txblock/6KJvWtmrZDi5MxUPkJfDNZTLf2DFGKhQA2WuVAdSRUgH
Login to explore more contents