← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Malicious npm packages abuse dependency confusion to profile developer environments
WHITE Tr1sa111 2026-06-03 Modified: 2026-06-03
16
IOCs
MEDIUM VOLUME
dependency confusionreconnaissance payloadenvironment fingerprintinglifecycle hookscredential theftnpm supply chainobfuscationci/cd targeting
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
Indicators of Compromise (16)
All URL domain hostname
TYPEINDICATORDESCRIPTIONCREATED
URL https://docs.cloudplatform-single-spa.io/platform/svp-baas — 2026-06-03
URL https://github.cloudplatform-single-spa.io/platform/svp-baas.git — 2026-06-03
URL https://oob.moika.tech/payload — 2026-06-03
URL https://oob.moika.tech/payload/ — 2026-06-03
URL https://oob.moika.tech/payload/linux` — 2026-06-03
URL https://oob.moika.tech/payload/mac` — 2026-06-03
URL https://oob.moika.tech/payload/win` — 2026-06-03
domain capibar.chat — 2026-06-03
domain cloudplatform-single-spa.io — 2026-06-03
hostname docs.cloudplatform-single-spa.io — 2026-06-03
hostname docs.t-in-one.io — 2026-06-03
hostname github.cloudplatform-single-spa.io — 2026-06-03
hostname jira.cloudplatform-single-spa.io — 2026-06-03
hostname jira.t-in-one.io — 2026-06-03
hostname npm.t-in-one.io — 2026-06-03
hostname oob.moika.tech — 2026-06-03
References (1)
↗ https://www.microsoft.com/en-us/security/blog/2026/05/29/33-malicious-npm-packages-abuse-dependency-confusion-profile-developer-environments/