{
  "Event": {
    "analysis": "1",
    "date": "2026-06-17",
    "extends_uuid": "",
    "info": "[Threat Intel] 140+ npm Packages Compromised in Coordinated Supply Chain Attack",
    "protected": false,
    "publish_timestamp": "1782364282",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782364282",
    "uuid": "79140557-e79d-42f1-ac42-9cfda99c9709",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#5c57c8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#62e1b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#b76d96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#d596aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#15723e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Launch Agent - T1543.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0cbec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Systemd Service - T1543.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#552d0d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"XDG Autostart Entries - T1547.013\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"37ebf9d7-5e9a-466f-a42c-6e60313db868\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781751620",
        "to_ids": false,
        "type": "link",
        "uuid": "fdfff577-bdff-420f-bd32-40b4840a70b4",
        "value": "https://socket.dev/blog/mastra-npm-packages-compromised"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781751620",
        "to_ids": false,
        "type": "text",
        "uuid": "49195499-7cf3-496a-a535-9882d04ca42d",
        "value": "More than 140 Mastra npm packages were compromised through a supply chain attack that injected a typosquatted dependency called easy-day-js. A single npm account published malicious versions within a short timeframe, affecting packages including @mastra/core with over 918K weekly downloads. The attack executes during npm install via a postinstall hook, deploying a two-stage payload. The first stage disables TLS validation and downloads a second-stage implant that installs cross-platform persistence on Windows, macOS, and Linux. This implant functions as a command-and-control client that steals cryptocurrency wallet inventories from 166+ browser extensions, harvests browser history, and can execute arbitrary code sent by operators. The malicious code executes before developers import packages, compromising systems during installation."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781751620",
        "to_ids": false,
        "type": "text",
        "uuid": "a779f07d-d4d7-4f90-8fe8-7c16883da11d",
        "value": "Name: 140+ npm Packages Compromised in Coordinated Supply Chain Attack\nAuthor: AlienVault\nAdversary: \nTags: [\"infostealer\", \"persistence mechanism\", \"easy-day-js\", \"supply chain attack\", \"cryptocurrency theft\", \"postinstall hook\", \"typosquatting\", \"cross-platform stealer\", \"npm packages\"]\nTgtd countries: []\nMlwr families: [\"easy-day-js\"]\nAttack_ids: [\"T1132.001\", \"T1059.007\", \"T1543.003\", \"T1497.001\", \"T1082\", \"T1005\", \"T1140\", \"T1185\", \"T1555.003\", \"T1083\", \"T1057\", \"T1041\", \"T1547.001\", \"T1027\", \"T1195.002\", \"T1543.001\", \"T1070.004\", \"T1071.001\", \"T1543.002\", \"T1547.013\"]\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782354675",
        "to_ids": true,
        "type": "url",
        "uuid": "a08cfccf-1887-43aa-8346-0fc783f2a8b9",
        "value": "https://23.254.164.92:8000/update/49890878",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782354696",
        "to_ids": true,
        "type": "url",
        "uuid": "84dbc29f-bdf9-48cb-9eb1-9ce6a9bc6a64",
        "value": "https://23.254.164.92:8000/update/49890878'",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782354717",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2201735a-a9c0-4a54-9eb6-e99e6312febb",
        "value": "hwsrv-1327785.hostwindsdns.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782354738",
        "to_ids": true,
        "type": "hostname",
        "uuid": "2d339abb-2a77-42aa-8f61-9a5847e56a0f",
        "value": "hwsrv-1327786.hostwindsdns.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782354759",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "737fbddc-36e1-4f24-ab5c-f427f873a64e",
        "value": "23.254.164.92",
        "Tag": [
          {
            "colour": "#c61cc6",
            "local": false,
            "name": "asn:asn=\"54290\"",
            "relationship_type": ""
          },
          {
            "colour": "#a9445b",
            "local": false,
            "name": "asn:as-owner=\"HOSTWINDS\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782354780",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "70aa5b20-8989-4bed-bfed-296fac4e8ee2",
        "value": "23.254.164.123",
        "Tag": [
          {
            "colour": "#c61cc6",
            "local": false,
            "name": "asn:asn=\"54290\"",
            "relationship_type": ""
          },
          {
            "colour": "#a9445b",
            "local": false,
            "name": "asn:as-owner=\"HOSTWINDS\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782354801",
        "to_ids": true,
        "type": "url",
        "uuid": "9dc1c089-a338-4b31-8444-98af2aadb2a9",
        "value": "https://23.254.164.123:443/49890878",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782354824",
        "uuid": "1064dd11-8d79-40e4-9d3c-92c0fcc2a504",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "stage-2 stealer",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782354824",
            "to_ids": true,
            "type": "md5",
            "uuid": "0d0ae1e7-8b19-4425-91fc-b25da467781c",
            "value": "c18fd75526533dfc90e91e2fb80effaf",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "stage-2 stealer",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782354623",
            "to_ids": true,
            "type": "sha1",
            "uuid": "eac07efc-28d5-4d12-be97-f64301c7b489",
            "value": "cd1129d1522a553d0365c433657cee39e4fae82d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "stage-2 stealer",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782354623",
            "to_ids": true,
            "type": "sha256",
            "uuid": "84d26144-ceba-4cf4-84c7-113111f78c2c",
            "value": "221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782354254",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b9d7f09b-ee98-473b-85ad-8f328b19b6f5",
            "value": "768:T31VrLI/qLyclwxPIfm8DVs3dJ3txUFvkE2fDDjeeGZ6D8QfmkwkmQw0QZC:ZVXsslwUqt9aaDrIQJyC"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782354254",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "6e664df8-3994-47e1-9517-878e1fcfbed6",
            "value": "41461"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782354254",
            "to_ids": true,
            "type": "vhash",
            "uuid": "cf90f3c4-2107-41b6-9aaf-4d423f547910",
            "value": "0511874f48b83c3574b784cdf08d7867"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782354254",
            "to_ids": true,
            "type": "filename",
            "uuid": "9762a846-6b9b-4ea7-a310-c6bf3b1550cd",
            "value": "protocal.cjs"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782354254",
            "to_ids": false,
            "type": "text",
            "uuid": "745dcbc3-7570-4999-8cc9-6d1818e2dc76",
            "value": "stage-2 stealer\r\nType Description: JavaScript\nMicrosoft: Trojan:JS/ShaiWorm.LTSN!MTB\nVT Total Detection:27/59\nFirst Submission:2026-06-17T04:42:51.000000+00:00\nLast Submission:2026-06-17T04:42:51.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782354845",
        "uuid": "c2c4a5ea-b062-4370-859c-aac6e10fd44e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "loader variant",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782354845",
            "to_ids": true,
            "type": "md5",
            "uuid": "9aa48fa7-970d-4eb9-9571-9ba9a670fece",
            "value": "ea5f9ef6c5cd7884d34c4baff0bc71d0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "loader variant",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782354624",
            "to_ids": true,
            "type": "sha1",
            "uuid": "dd15c32e-35b0-4c50-8e16-a5ff87178766",
            "value": "d920f76dd18f5c6cb789f1ecd105254ff1473b9d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "loader variant",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782354624",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a8caced0-ecfb-4aa8-bec4-03e5306ed662",
            "value": "9570f77a5e1511869f4e554e7166df9fde081f2583e293c2569621792ed7d9c9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782354276",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "38ef1124-5778-4425-a046-f6ff4ac9b8ea",
            "value": "96:G3loW+bsT/RNIaVs0uVt9bSbLuykS8SmN+zPjMs3uRYwJ9JA0n:SiW+IT/R20I7+/uykS8SM+zPjMguRYwr"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782354276",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "1ed52f4c-8cb8-4377-a25f-12f25361f357",
            "value": "5397"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782354276",
            "to_ids": true,
            "type": "vhash",
            "uuid": "be2eff46-d546-459e-9456-805a7fb0e8a5",
            "value": "72ce4e8c01bfef28ef29bb97fcb12220"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782354276",
            "to_ids": true,
            "type": "filename",
            "uuid": "96ee97d1-3a9e-4dc4-9711-58b6f5958e22",
            "value": "output.clean.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782354276",
            "to_ids": false,
            "type": "text",
            "uuid": "04abe579-ed73-4fa0-8caa-b2300b5d524b",
            "value": "loader variant\r\nType Description: JavaScript\nMicrosoft: Trojan:JS/NpmSteal.DE!MTB\nVT Total Detection:22/60\nFirst Submission:2026-05-29T09:36:16.000000+00:00\nLast Submission:2026-05-29T09:36:16.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782354866",
        "uuid": "b65786a2-e811-47d9-8f1a-63f1d9917c19",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "easy-day-js setup.cjs (stage-1 loader)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782354866",
            "to_ids": true,
            "type": "md5",
            "uuid": "c0155972-f0ac-48e3-a0cf-52e405360532",
            "value": "f29630beb594dbf25e738165705bb4a5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "easy-day-js setup.cjs (stage-1 loader)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782354625",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d95cdfa9-6117-4d93-8f6b-24fb9c8fa92b",
            "value": "52baf9cedd288b0d53a5caed3e103487d9412ab9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "easy-day-js setup.cjs (stage-1 loader)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782354626",
            "to_ids": true,
            "type": "sha256",
            "uuid": "4510a348-7821-4231-8660-7c7f7e470e46",
            "value": "b122a9873bedf145ae2a7fd024b5f309007dbb025149f4dc4ac3f7e4f32a36a4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782354298",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a47048df-49cd-4fe4-bd31-11f731a35bb5",
            "value": "96:lL7+M8pwGCuh53mAY52XOOLHQ/a0cqw1VlIcc8j:lLSMFPuh5Ne2eOE/as4bZcE"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782354298",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0e44bd03-d6b0-4582-8648-5b049c1930fb",
            "value": "4572"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782354298",
            "to_ids": true,
            "type": "vhash",
            "uuid": "be3fc1a7-0b1a-4eb8-b242-c16aedd0c89c",
            "value": "47fbe894a29d8c410aa49b3a1d03c469"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782354298",
            "to_ids": true,
            "type": "filename",
            "uuid": "58448d37-cac8-429a-a6a5-fafa46cfeda9",
            "value": "setup.cjs"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  23/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782354298",
            "to_ids": false,
            "type": "text",
            "uuid": "ae52667d-29b2-4f53-97b9-1758b78d6076",
            "value": "easy-day-js setup.cjs (stage-1 loader)\r\nType Description: JavaScript\nMicrosoft: Trojan:JS/Obfusnpm.GVZ!MTB\nVT Total Detection:26/60\nFirst Submission:2026-06-17T04:36:54.000000+00:00\nLast Submission:2026-06-17T04:36:54.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782354888",
        "uuid": "a21b4f68-8905-4c61-952e-a42446e7e981",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "easy-day-js@1.11.22 package.json",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782354888",
            "to_ids": true,
            "type": "md5",
            "uuid": "4d7acac8-19fe-442b-b298-8993536b4a2c",
            "value": "fb0b1e1857e73d59dee02eb2be86169a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "easy-day-js@1.11.22 package.json",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782354627",
            "to_ids": true,
            "type": "sha1",
            "uuid": "2cc65df2-6a94-4c2e-bbd6-38dda87067e3",
            "value": "7dbd7001723ff73941083ccf060f370aaf3ab8cc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "easy-day-js@1.11.22 package.json",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782354627",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f3a5e2e4-c74a-41fd-ae8a-dc6ad0af2683",
            "value": "c38954e85bf5433e61e7c8f4230336695624ae88b6953afabf7bf817aa91b638",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782354319",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "34d9e947-5096-48c6-8b51-05e165d7daca",
            "value": "48:mwUyqhs+LKZ/FKxEc/LT72ei6ZuOHZbd/JhmAgLEpRep1pqQDrQ3d2mpJkuc:Gyqhs+LKZ/FQT72czZbDhmZURe7tH0J2"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782354319",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "f6b425fe-9199-46e1-8701-21cdb110b9d2",
            "value": "2733"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782354319",
            "to_ids": true,
            "type": "filename",
            "uuid": "bbe842f2-24e1-424e-a1be-28ecbe4f2142",
            "value": "package.json"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  22/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782354319",
            "to_ids": false,
            "type": "text",
            "uuid": "c9bdbbf5-cf8f-43cc-a70d-7fcfb3156571",
            "value": "easy-day-js@1.11.22 package.json\r\nType Description: JSON\nMicrosoft: None\nVT Total Detection:0/59\nFirst Submission:2026-06-22T11:20:09.000000+00:00\nLast Submission:2026-06-22T11:20:09.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782354909",
        "uuid": "dbeb45e4-69d4-4996-9588-4fb0d2574d78",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "loader variant",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782354909",
            "to_ids": true,
            "type": "md5",
            "uuid": "a03c01a6-79cc-4e36-9d31-0b1e8753bd2d",
            "value": "a84412efcc457c5666f23b3d44cae281",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "loader variant",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782354628",
            "to_ids": true,
            "type": "sha1",
            "uuid": "bbaa6de4-c736-4364-acc9-40aa173d4f32",
            "value": "ae81b945ae8fe52211c399ffdafd45c77d8c1fab",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "loader variant",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782354628",
            "to_ids": true,
            "type": "sha256",
            "uuid": "7d45e0b5-ad45-4d43-9970-431812bfaa67",
            "value": "cdec8b20338beb708b5be8d3d7a3041a35a8b0fb92f9186262f312d55ff82066",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782354341",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "34160132-9583-4beb-a5f6-d78fb13d50be",
            "value": "96:r3loW+bsT/RNIaVs0uVt9bSbLuykS8SmN+zPjMs3uRYwJ9JA0n:TiW+IT/R20I7+/uykS8SM+zPjMguRYwr"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782354341",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d760e3da-38aa-4143-b04e-f2b0b77ac5ae",
            "value": "5414"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782354341",
            "to_ids": true,
            "type": "vhash",
            "uuid": "e971db5c-edaf-4042-8777-11c070780431",
            "value": "65a8fb30dbd5ec83a8d96a21b624b703"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782354341",
            "to_ids": true,
            "type": "filename",
            "uuid": "f341388b-b01d-4f44-9927-2f2d001e25e6",
            "value": "a.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  22/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782354341",
            "to_ids": false,
            "type": "text",
            "uuid": "2c468597-25da-4404-b8bc-5064b3e014b8",
            "value": "loader variant\r\nType Description: JavaScript\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:24/59\nFirst Submission:2026-05-29T09:50:32.000000+00:00\nLast Submission:2026-05-29T09:50:32.000000+00:00"
          }
        ]
      }
    ]
  }
}