Slopsec connoisseur
Joined May 2025
- Tweets 568
- Following 467
- Followers 183
- Likes 1,752
200 Photos and videos
Announcing my rejected talk for @bsidespyongyang:
Is that "web3 enthusiast" follower with the anime PFP acting suspicious?
Find out if you have confirmed North Korean followers at dprkdetector.app.
9
8
52
18,587
Scam alert🚨
A fake account of one of @EthPrague organizers reached out to me and asked to join a workspace
Some people I know also got targeted from other fake accounts
Be extremely careful and never copy and run scripts that you don't know, even if they're from "Google".
9
2
18
3,451
>hacker "did something"
>The money is gone
Thank you for attending my PM
lmaooooooooooooooooo "we're not a casino" doesn't make up for your atrocious post-mortems
(regarding summer 2021 exploit #2...or maybe #3. this one 0x3a196410a0f5facd08fd7880a4b8551cd085c031)
2
54
5 hours old. Detected by @SocketSecurity as malware. @sonatype flags as suspicious but not malicious.
1
52
Another one from the same family - not detected by @sonatype or @SocketSecurity yet (env-threads)
Same C2
npmjs.com/package/env-thread…
NPM Malware Alert - npmjs.com/package/env-nodejs
All versions drop a Windows stealer. Still live on NPM right now. Your pnpm cooldown scripts might not stop this - first commit was a month ago.
IOCs:
- emphasis-friday-even-administrator<.>trycloudflare.com/download/e…
1
1
129
There should be no less than a dozen yara rules firing on this. Looks like regular obfuscator.io patterns. Huge entropy. Node OS shelling.
1
39
I stepped away for lunch today and used Codex /goal to deploy my web service, but my VPN timed out somewhere in that window.
Because Codex was connected to Slack MCP it sent a message to several channels, and then later, DMs.
I disconnected everything so fast, huge wtf moment.
75
NPM Malware Alert - npmjs.com/package/env-nodejs
All versions drop a Windows stealer. Still live on NPM right now. Your pnpm cooldown scripts might not stop this - first commit was a month ago.
IOCs:
- emphasis-friday-even-administrator<.>trycloudflare.com/download/e…
1
218
1
25
For those of you investigating a suspicious DM, here are the indicators:
Reece Rogers @ ReeceHODLx (568236078)
Zoe Schiffer (@ Zoe_Schiffer) (8542625522)
Simon Polrot (@ simonpolrot) (8216216039)
luma.com/9jf4yvhj
calendly.com/nowmedia-podcas…
41
Some ideas:
EDUCATION
- @theredguild
qf.giveth.io/project/the-red…
- @cyfrinupdraft
qf.giveth.io/project/cyfrin-…
- @defihacklabs
qf.giveth.io/project/defihac…
If you’re tired of watching exploits dominate the timeline, this is your moment to act.
The Ethereum Security QF Round is LIVE!
Support the people and projects securing Ethereum and its L2s.
500 ETH (~$1M ) in matching from @thedaofund.
Explore & donate:
qf.giveth.io/qf/ethereum-sec…
2
1
8
712
@_SEAL_Org :
SEAL 911
qf.giveth.io/project/seal-91…
SEAL Intel:
qf.giveth.io/project/seal-in…
SEAL Frameworks:
qf.giveth.io/project/seal-fr…
1
60