Community

One conversation, in two places

Comments on this page are GitHub Discussions. Post here and the thread appears on the repository; reply on GitHub and it appears here. There is no separate account, no second inbox, and nothing to moderate twice.

Where things live

Pick the room that fits

DiscussionsOpen questions, ideas, show and tell. Start a thread with a GitHub account. Q&A"Is this thing in my repo?" — answerable questions, with accepted answers. Field reportsWhat you saw, what it cost, any variant you found. Redact tokens first. Bugs and variantsA false clean is the one we most want to hear about.
Credit

Who found what

Every detection snare has for this campaign came from someone finding it on their own machine first and writing up what they saw. None of it was found by reading code.

  1. @kleenpulse — campaign 4738-2, from a live Windows hostThe patched cli.js Defender did not flag, the PowerShell clipboard stealer, the api.js wired into the run scripts, and the forged force-pushes that read as 1 ahead, 1 behind with identical messages. Snare now detects all four, and the forged-push check is a direct implementation of the method in that report. #47
  2. @ibraheembello — npm on Windows was never checkedsnare doctor printed no npm installation found to check on every Windows host while a trojanised cli.js sat in %APPDATA%\npm and ran on every command. Also suggested the size heuristic that now catches this without knowing the malware at all. #46
  3. @SamuelOshin — four remediation bugsA 0-byte fake font that fix skipped, a tasks.json with comments that fix deleted whole, a phantom origin branch pushed to the remote, and a failed push reported as a success. All four reproduced exactly as described. #44
  4. @phoenixdahdev — remediation deleted the files it was meant to cleansnare fix removed build configs instead of stripping them, so the fix was its own outage. #39
Still unanswered

The two questions nobody has answered

These are not rhetorical. Nine infections across five contributor identities over two years is not one laptop, and no delivery mechanism has been established.

  1. How does this family actually reach developer machines?Every payload seen so far was a modification of an already-clean config, never a fresh file — which rules out a contaminated template as the whole story. A shared upstream source (a scaffold, a create-* command, a downloaded theme, an editor extension) is the leading theory and remains unproven. If you can say what you scaffolded an infected project with, that is the most useful thing you can contribute. One concrete chain is now on record (#47): an IDE language server ran npx -y chrome-devtools-mcp@latest, which went through the already-patched npm in the global prefix. That explains how the payload keeps running — including from MCP servers an editor starts on its own — but not how it got onto that machine to begin with.
  2. Can a defence propagate the way the infection does?Without becoming a dropper itself. This is an open design question, and a genuinely uncomfortable one.

Before you post details

Redact tokens, keys, internal hostnames and anything that identifies a client. You do not have to name an employer — "a fintech I contract for" is a perfectly good data point. If you would rather not post publicly at all, open an issue saying so without the specifics and we will find another way.

Comments

Say something here

This thread is a GitHub Discussion. Signing in with GitHub is only needed to post — reading requires nothing.

Loading the discussion thread…

Comments are powered by giscus, which stores every comment as a GitHub Discussion on this repository. It is the only third-party code on this site, and it is loaded on this page alone — never on the pages that carry commands you might paste into a shell.