How do I report malicious repository

[Guillermo Bascuñana]

It's part of the crypto developer scam where the alleged recruiter sends you a repository to install and evaluate. Then drain your wallets, there is obfuscated js either in the code or in a cookie fetch with eval() . It's been like the 5th time in this month so I recognize the scam quick, this is the first one in bitbucket and can't seem to find a way to report it.

Here it is: 

https://bitbucket.org/mordern/project_a/src/main/

thank you

[Thales Santos · Accepted solution]

Hello @Guillermo Bascuñana

Welcome to the Atlassian Community. Thanks for bringing this up, I am raising it internally with our Bitbucket support team.

I can't promise an SLA on this, but they will review it. If you receive an email or you see anything suspicious you can also report it to abuse@atlassian.com

[Shrinath Prabhu]

@Thales Santos There is this one as well https://bitbucket.org/alchemer1/tradingview1/src/main/ , same pattern. They ask you to run the code on your local machine and then funds are drained

[Thales Santos]

Hi Shrinath, welcome to the community. I have reported this to the abuse team.

[Thales Santos]

@Shrinath Prabhu The repository has been taken down.

For you and everyone else coming across this thread if this is seen in the future, you can report it directly to abuse@atlassian.com

[Viktor Lazarov]

Another malicious repository relating to a crypto scam from a potential client on UpWork.

https://bitbucket.org/chateaux/meme/src/main/

[Thales Santos]

Thanks Viktor, it looks like the repository has already been deleted or moderated

[Arya]

Another similar repository here: https://bitbucket.org/financial-hub/staking-management/src/master/

This repository has been provided to me on Fiverr and is designed in similar fashion as the exploit here:

https://www.reddit.com/r/CryptoCurrency/comments/18sw38l/blockchain_devs_wallet_emptied_in_job_interview/

It's an old crypto dashboard template modified to scan for local crypto wallets and move the funds out.

I've ran it inside the VMWare, but could not identify how exactly this is being executed (Linux might not even be supported), but I assume it is somehow a part of the build / test chain, likely all the malicious logic is in https://bitbucket.org/financial-hub/staking-management/src/master/test.js

[Andy Heinzer]

@Arya Thanks for reporting it to us.  The repo has been suspended.

[Thales Santos]

@Guillermo Bascuñana would you be able to provide more information that this code can be a threat? Our team ran some checks and initially couldn't find anything, in order to do a takedown we would need more clear indication that this is indeed malicious.

Thanks