Context

Download an open-source large model, and what you usually worry about is whether it runs properly and whether the weights are genuine. This time, the real concern lies elsewhere: a repository labeled as having 27B parameters hands you only 487 KB—inside are not weights, but a data-stealing trojan.

On August 20, 2026, the GitHub repository unburdened-jackinthebox365/qwen38-uncensored committed a file named uncensored_qwen_v2.6.zip to the assets/ directory, totaling 487,153 bytes. The repository packaged it almost flawlessly: the homepage claimed to provide locally quantized weights for Qwen 3.8 27B, and the README emphasized fully offline operation, no telemetry, and data never leaving the local machine—each statement perfectly appealing to local model users. Four days later, on August 24, the README was modified again—the download button, download links within the body, and the two external links originally pointing to the Ollama and LM Studio websites were all changed to point directly to the raw URL of the same ZIP file.

At this point, the discrepancy is clear. A 27B parameter Q4_K_M quantized model typically requires over 16 GB of disk space, and the warning printed by the included bin/install.cjs script also states approximately 16.8 GB. Yet, the actual asset delivered is only 487 KB, and after extraction, it contains just three files—Application.cmd, util.exe, and cert.txt—with no GGUF weights whatsoever.

Based on this, we determine that this is a counterfeit repository distributing files under the guise of Qwen; the official Qwen project has not been compromised. The Node.js installation script in the repository appears to implement the workflow of "writing a Modelfile → calling ollama create," though dynamic verification was not performed in this instance. The main code maintains the appearance of a legitimate project, while the malicious ZIP is submitted as a download asset within assets/. Failing to unpack and inspect downloaded assets—while only reviewing standard source code—may cause this entry point to be overlooked.

This article relies primarily on static evidence and did not execute any samples. C2 requests were reproduced using simulated host data; only the responses were read and payloads downloaded, without executing the downloaded content or accessing the final upload endpoint. Descriptions of behaviors in this article refer to the existence of corresponding implementations or call paths in the code, and do not imply that these operations occurred on actual hosts.

MistEye response

MistEye is a proprietary Web3 threat intelligence and dynamic security monitoring system developed by SlowMist, integrating security monitoring and intelligence aggregation to provide users with real-time risk alerts and asset protection.

In this incident, MistEye conducted static analysis on the decoy repository, downloaded assets, and subsequent payloads; simulated host information to reproduce C2 requests, saved responses and download evidence, and reconstructed the multi-stage delivery chain while extracting network and file IOCs. On August 26, MistEye rechecked the C2 server viability and distribution infrastructure rotation, and performed offline behavioral comparisons on 29 similar ZIP files distributed across 23 repositories. The relevant IOCs have been integrated into MistEye’s threat detection engine.

Below is the detailed technical analysis.

Three files in the 487 KB download package

The entire content of Application.cmd is a single command:

Start util.exe cert.txt

Including line breaks, it totals 25 bytes. It does not unpack any model or invoke Ollama; instead, it simply has util.exe in the same directory read a text file, transferring control to the Lua script inside cert.txt. There are no other files in the archive—these three are the entire contents.

util.exe is 759,808 bytes and is a renamed LuaJIT 2.1 interpreter. LuaJIT itself is a Lua runtime used by numerous legitimate software applications. The remaining PDB path in the PE file, D:\a\defold\...\luajit.pdb, points to a build artifact from the Defold game engine. Static analysis found no malicious behavior in util.exe independent of scripts; the file is solely responsible for executing obfuscated Lua scripts in the same directory.

The file named cert.txt resembles a certificate but contains a single-line Lua script of 182,116 bytes. The entire script has no line breaks; all strings are split into decimal escapes and table lookups, making direct reading appear as nothing but numbers and short variable names. Below is a small excerpt from the beginning of the file, reformatted for readability with line breaks and truncated with ellipses:

The first two functions are responsible for retrieving characters by index and rearranging their order; starting from the third line is the scrambled string table. Hundreds of plaintext strings in the script are stored in this format and reassembled to their original form only at runtime.

The entry point for the risk is therefore not in the so-called model program. The archive provides a generic interpreter plus a text file, with all malicious logic contained within cert.txt.

C2 completed the subsequent delivery chain.

After offline deobfuscation, the structure of cert.txt became clear: it maintains a string table with hundreds of entries, where all plaintext is split into escaped numbers and restored byte by byte at runtime. The script uses LuaJIT FFI to parse and call Windows APIs such as VirtualAlloc and CreateThread.

The loader has ID 845. After execution, it collects the hostname, username, GUID, and system version; captures a screenshot using BitBlt and saves it as a BMP file; then makes a single request to an IP geolocation service to obtain geographic data. All this information is assembled into a multipart request and POSTed to the hardcoded IP address 217[.]119[.]129[.]122. Below is the actual request we reconstructed based on the script:

The string following /api/ in the path decodes to the client ID 517b7c5e5663656a057f. The screenshot is located in the file section, where entries starting with BM are indeed BMP file headers; host information is contained in the data section, both within the same request. After decoding, the data contains simulated values such as computer=SIMULATED-PC&user=simulated-user&query=203.0.113.10, which do not correspond to any real host.

Tasks downloaded from the server are processed separately based on file extensions, covering four types of payloads: in-memory execution, standalone programs, DLLs, and scripts. A single loader can handle nearly all common payload formats. The script includes provisions for Defender exclusions, scheduled task persistence, and task completion reporting—all located within conditional branches that are triggered based on server-side loader configurations and local conditions. The current configuration received has enabled only persistence; the other features are disabled. These are conditional functionalities and do not indicate that the corresponding actions have been executed on the actual host.

When the hardcoded address fails, the loader has a fallback path: it initiates an eth_call to the Polygon chain to read the return value of selector 0x3bc5de30 from contract 0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc, from which it parses the fallback C2; in this actual test, it resolved to 194[.]48[.]248[.]94:

The length prefix 0x14 is 20, exactly matching the number of characters in the decoded address, confirming each other. This hex data can be independently verified by consulting an ASCII table once, without relying on our decoding script. Of the five RPC endpoints configured in the script, three returned the above data with byte-for-byte consistency, one required a paid subscription, and one outright rejected the request. After writing the address to the blockchain contract, changing servers requires only a single transaction; blocking the current backup IP alone cannot prevent the contract from returning new addresses in the future.

After correcting the request format according to the script, beacon 845 received an HTTP 200 response with a 1,248-byte JSON payload.

The response field is encoded in three layers, and the decoding order is Base64 → lowercase hex → 32-byte cyclic XOR, with the XOR key ECe6VGLRJum2qYtl79OiOU7aHot7Zhbn hardcoded in the script. Below are the first 56 characters of the response before and after decoding:

Solved: a loader strategy and one task:

The pump field controls whether random data is used to extend the output file to the size specified by the server; this option is currently disabled for this task.

Download a file named `tool.log` to `%TEMP%\dist.lua` and execute it. The file is 396,616 bytes and consists entirely of ASCII hexadecimal data; after hex decoding and XOR decryption, it yields a 198,308-byte obfuscated Lua script. This is the second loader, identified as #847, with its initial C2 changed to `217[.]119[.]129[.]97`, and its obfuscation layout is isomorphic to #845. After executing loader #847 using the same simulated host data, it sends a beacon to `217[.]119[.]129[.]97`, and the server responds with two tasks.

In both tasks, one remains `tool.log`, while the other points to `verb.log` in the same repository, with the destination path written as `AppData\..\Local\Programs\Chromium\Application\Chromium.exe`. The middle `..` traverses up to LocalAppData, ultimately disguising the file name as the main Chromium browser executable.

tool.log, verb.log, and the subsequent two PE files all originated from C2 responses and were downloaded to disk; these files were not present in the original ZIP. The ZIP itself only proves that the loader has the capability to download and execute files; the saved C2 responses show that, at the time of collection, the server issued subsequent download tasks to loaderId 845.

StealC payload extracted from verb.log

verb.log is 3,089,408 bytes, also in ASCII hex, with the transformation chain: hex/XOR → outer PE → Base64URL/AES → inner PE. Using the same XOR key, it decrypts to a 1,544,704-byte 64-bit outer PE. The Base64URL text within its resource section decodes to a 797,728-byte AES-256-ECB ciphertext. The key bFYh8UMQGZOBUlvrpS3M4ZJybbubVbvg is derived statically from two constant arrays in the outer PE; decrypting with this key yields a second 64-bit PE of the same size, 797,728 bytes.

The outer PE manually maps the inner PE within its own process: allocating memory, copying headers and sections, fixing relocations and import tables, and creating a thread to start at the entry point. The static call chain contains no cross-process injection APIs such as CreateProcess, WriteProcessMemory, SetThreadContext, or ResumeThread—the entire process is an in-process reflective loading.

The inner payload first checks the environment: if the system's default language is Russian, Ukrainian, Belarusian, Kazakh, or Uzbek, it exits; then it uses a uniquely generated event name based on host information to enforce single-instance control, followed by validating the embedded expiration date. Only after all checks pass does it proceed to the main logic.

Browsers: Chrome, Edge, and Brave retrieve login data, cookies, history, and related databases; Firefox uses the NSS interface to decrypt saved login information. When the database is locked, use Restart Manager to terminate the occupying process.

Email and Operations: Foxmail and Outlook account credentials, WinSCP session information, where each WinSCP session directly corresponds to a server accessible to the victim.

Steam: Login configuration, token, and sentinel files.

Starting with Chrome 127, cookies and saved passwords are protected by App-Bound Encryption, with keys stored in system-level services; simply copying the database files will not yield plaintext. This payload includes a built-in auxiliary PE that uses Early-bird APC injection to enter suspended chrome.exe, brave.exe, or msedge.exe processes; the auxiliary module reads the encrypted App-Bound Key within the browser process and exports the 32-byte plaintext key via the corresponding COM Elevation service interface for each browser, making the previously collected database files readable again.

Wallet harvesting is entirely server-driven: the recursive collector assigns file tasks from C2 based on type, with the wallets branch searching local directories by task name and file name; C2 can also issue extended IDs to harvest storage and IndexedDB data from corresponding Chromium extensions. The sample contains no plaintext wallet brand names or installation paths, nor any implementation for parsing mnemonics like BIP39 or private keys using secp256k1— which wallet to harvest is determined by the server when issuing the task, and the static sample cannot list the current target inventory.

The payload also includes screenshot capture, collection of system information and process lists, secondary download and execution via PowerShell, privilege escalation, and self-deletion upon exit.

Data is uploaded via JSON POST in 512 KiB chunks. The upload endpoint, stored in the file encrypted with RC4 and then Base64-encoded, decrypts using the configuration key 55uUe45tr1x1xy1lSK to http[:]//89[.]169[.]12[.]194. The request body is further encrypted using a separate RC4 key.

StealC is a Windows information-stealing trojan designed to steal browser credentials, cookies, crypto wallets, and other sensitive data, then transmit it to the attacker’s C2 server. The collection scope of the inner payload, App-Bound decryption assistance, wallet branching, and RC4-encrypted uploads all align with known StealC characteristics, leading us to classify it as StealC.

If these materials are successfully obtained, the consequences vary: browser cookies can lead to hijacked active sessions, email and Steam credentials can result in account compromise, WinSCP sessions can expose servers managed by the victim, and once wallet private keys or recovery phrases are leaked, asset transfers cannot be reversed.

Recheck confirms that the distribution facility is rotating.

On August 26, we resent the three beacons using the same mock host data. All three endpoints returned HTTP 200, and the loader policy field remained unchanged. The change appeared in the download URL within the task.

vs.log is byte-for-byte identical to the old tool.log, only renamed; the 847 loader remains unchanged. After decoding, ssl.log contains a new version of the outer PE, 1,539,072 bytes in size, with a modified entry point and image size; the AES key has been rotated to yK8-eM8KFA8Hl8cCybERmOLZupFvfCNZ.

The inner payload decrypted with the new key is still 797,728 bytes. A byte-by-byte comparison with the previous version reveals only one difference, located in the read-only data segment: the build number reported to the server has been changed from build5 to build1. The upload endpoint, RC4 configuration key, and request body key remain identical.

Changing the warehouse, renaming files, updating the outer PE, and switching AES keys render the exact hash of the old file invalid. Whether stable structural and behavioral characteristics can still be detected must be verified by specific rules. The core of the data-stealing payload remained stable over these two days, with only a version tag modified; this observation between two collection days is insufficient to determine whether it will remain unchanged over a longer period.

More malicious GitHub repositories

We additionally collected 29 malicious ZIP samples distributed across 23 GitHub repositories. Initial analysis revealed that all samples utilize Lua as part of their execution chain, commonly in the form of locally invoked LuaJIT or renamed interpreters triggered by .cmd or .bat launchers, which then execute Lua scripts located in the same directory. The bait themes of the associated repositories span multiple categories, including AI models and tools, MCP services, development scripts, and wallet projects.

It should be noted that a complete code reconstruction and attack chain analysis has not been performed on each of the 29 samples; therefore, the current evidence only confirms that all samples exhibit malicious behavior and commonly use the Lua technology stack, but it cannot be concluded that all samples employ identical obfuscation methods, execution flows, C2 infrastructure, or final payloads.

Summary

A fake GitHub repository impersonating Qwen directs the download link to a 487 KB ZIP file containing no model weights, only a LuaJIT interpreter and an obfuscated script. The saved C2 response is linked to an inner payload designed for data theft, which we classify as StealC.

The risks involve browser sessions, email and operational credentials, Steam tokens, and wallet-related materials, provided these items are successfully obtained. Between the two collections, the distribution repositories, filenames, outer PE, and AES keys have changed, while the inner payload differs by only one character in the build number; 29 similar ZIP files distributed across 23 repositories indicate this delivery framework has been mass-reused, but the complete subsequent chain for each variant must be verified on a sample-by-sample basis.

Recommendation

1. Isolate and collect evidence: When a host triggers a match for any ZIP file, script hash, C2, or download URL listed in this article, preserve the download source, process tree, network connection logs, and dropped files before proceeding with cleanup.

2. Check for host modifications: If you find execution records of the launcher, or records of LuaJIT or renamed interpreters loading large volumes of obfuscated text, inspect scheduled tasks, the Run key, and the StartupApproved entry, and verify whether the system drive or .exe and .dll file extensions have been added to the Defender exclusion list.

3. Credential Remediation: Upon confirmation of sample execution or detection of related payloads, reset browser sessions and saved passwords, email accounts, Steam tokens, and WinSCP session credentials. If wallet private keys or seed phrases were ever stored on the host, first migrate assets to a new address before addressing the host itself.

4. Add composite detection: Include the sequence “Small launcher → Local LuaJIT or renamed interpreter → Large single-line text in the same directory → Initiate HTTP request or write to executable memory” in the monitoring rules. This chain relies solely on legitimate services; detection should be based on behavioral patterns combined with the precise malicious URLs listed in this document, and should not broadly block GitHub Raw or public Polygon RPC endpoints.

IOC

217.119.129.122

194.48.248.94

217.119.129.97

89.169.12.194

http://217.119.129.122/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y=

http://217.119.129.97/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y=

https://raw.githubusercontent.com/unburdened-jackinthebox365/qwen38-uncensored/main/assets/uncensored_qwen_v2.6.zip

https://github.com/Minaadelfouad64/tools/raw/refs/heads/main/verbose/tool.log

https://github.com/Minaadelfouad64/tools/raw/refs/heads/main/verbose/verb.log

https://github.com/fuhuhlatoogan/mtp/raw/refs/heads/main/p/vs.log

https://github.com/fuhuhlatoogan/mtp/raw/refs/heads/main/p/ssl.log

https://github.com/unburdened-jackinthebox365/qwen38-uncensored

https://github.com/Minaadelfouad64/tools

https://github.com/fuhuhlatoogan/mtp

https://github.com/0ogata0/qwen-php-client

https://github.com/115th-discomfited211/Awesome-Harness-Engineering

https://github.com/123affano1/claudetrack

https://github.com/1sustgmboab/nexonco-mcp

https://github.com/2josEx/claude-brain

https://github.com/428alexander9/claude-skills-marketplace

https://github.com/45d5r/databricks-mcp-server

https://github.com/7ossamfarid/mcp-mindmesh

https://github.com/Bean5789/bbd2api

https://github.com/CleverPortal/CollabNote-Fullstack-App

https://github.com/Juanvil9941/AI-Invoice-System

https://github.com/Kalainilavann/takeout_downloader_script

https://github.com/Prestonflatfooted659/Void-Tools-v2.0

https://github.com/Walloperlioncub193/Canva-Resource

https://github.com/archontelemetered604/clash-for-windows

https://github.com/fantastic-interpolation620/ctx-wire

https://github.com/mikenob39wang/phone-number-location-tracking-tool

https://github.com/recognisable-riddance165/Portable-Offline-LLM

https://github.com/sociologisttentcaterpillarmoth213/100xdev-ci-cd

https://github.com/soldat-panther/qq-farm-cdp-auto

https://github.com/thaddeusprobabilistic193/Xault-Wallet

https://github.com/twelfth-puerperium297/tokenoptim

https://github.com/wasila7220/multi-model-router

filename: uncensored_qwen_v2.6.zip

MD5: bf21a07ad5743d3ae9f55ff526428a0a

SHA1: 8e3391c17c3f4fb6f42594de7425df96dbbbc01e

SHA256: 36d0bac5743ed9c6858258f28f2c2f9161dc06c4d5af73eb7eda1211ea610758

filename: Application.cmd

MD5: 17d94f34b9d15449b03bc099a637782b

SHA1: eb474f898256e8e7baaf0d63b306d1169e637c73

SHA256: 7c4f3e09c6428d0a0d7d85615695f5fedb35bb4e7180d31e1f8a1bacf22e5639

filename: cert.txt

MD5: ccfc0f145861f23c6850c691c4be54b9

SHA1: b88ac887493f31cf9f160ddbc6bc3a2aa298a0ca

SHA256: a75561a3224d9f836058a6d0204ed2e6c1f638275a59495935cd2a5e46fd28ca

filename: tool.log, vs.log

MD5: 8063ba8ec896b52e5e6d435cc60e82f7

SHA1: f445bd4c5b65b7e013ec518f34f4cd64676201d2

SHA256: 7ebbb61733d8aefcf9401f00e8ff7e593c9f0edecb6609675aebd3eb78a5ae2d

filename: verb.log

MD5: 650a8ee5d091275040ae4dd02dcdd806

SHA1: 343d819ceb63c742912723c42fd158b82d0a90be

SHA256: 699af883d862d8949a494f69e2d300142ce506a0ac6c7a239193c111dfed241e

filename: inner-payload.aes256-ecb-decrypted.bin

MD5: 01e433263a7fd50e812195ff4c11cc90

SHA1: ea53a41c53181374cade8d69882bb1390f0c2562

SHA256: ec981c45d494896037583c746543490176c9ce9a1482e62c4e8ab189c2650b1c

filename: ssl.log

MD5: 9d11bce9c213924b53bcb986f07945c6

SHA1: 2abf1436933dc6b63a016661d5d16f1eda303b59

SHA256: 7b0d919bd510cbcc587cca4b74aad1e086fb1fc34882a39946e6db7d4361a746

filename: inner-payload.build1.bin

MD5: 370f95bf40a9c9fe852b2e4bdd95689f

SHA1: 219a0e7c3907bb65ef7db7428400745570d4e105

SHA256: 5d63f3dc9371d4496ca0e728a794151978e94b69ae4b3c705cea4e67cc6cf208

filename: client_qwen_php_v2.4.zip

SHA256: 073c6192ab4c2d5d25fc13acab4c216c96f9d5926064c534e3803bb31d527b28

filename: Engineering_Harness_Awesome_1.9.zip

SHA256: 0870fe8a4d9e64e335047e16ed1d6b0805beab9686495a1e8c247cf2e1a8e930

filename: Software_v1.6.zip

SHA256: 71b37b48f80106fc864be7e82481cd1a2f7decfeaf1dce45abb924d7f32da933

filename: nexonco-mcp-v3.0-alpha.1.zip

SHA256: a866d90d6f1dd82ddcd2cbef4f5550c77bb58dbda87c02eedb441a117b7d89b9

filename: claude-brain-v1.4-alpha.3.zip

SHA256: a271231ebf6174b11aeb3337c238abc0eac44b48b5fa8d2b168883601d8cc3a5

filename: brain_claude_2.2-alpha.1.zip

SHA256: ca4babb4444af81cf93b34436de7a4a3c8e1a93f6233bcc8753ddd868b4c9eaa

filename: claude-skills-marketplace_v3.4.zip

SHA256: 438033226b1bd1e26db8ab71a777e74cc90b5c31310139269fe8e52308f6c938

filename: skills-marketplace-claude-2.9.zip

SHA256: f07a4eadd43513f56ae4fdf6f6dfc966de17f06093c75c1dec0dd426668779f9

filename: server_databricks_mcp_1.6.zip

SHA256: 66afc7d87d10dbe392898c4e5c613e0442fabb396415c2bef3a5ef2ac752c5ad

filename: mindmesh_mcp_1.0-alpha.5.zip

SHA256: e8da8c82ccb1c6fd68e7c03187485d6ebbd07a4946a7f07cac54fef65b00d2bf

filename: bbd-api-3.1.zip

SHA256: 3524dc4a232c76067f8b2df9adf34ae1106dcc1528e5467c1abc285fc51d1e82

filename: Note-Collab-App-Fullstack-v3.6-alpha.5.zip

SHA256: 6f823d15658b07d6d90f292848fcdd30fe840f83d653cc34966e2fd61d9c3117

filename: Invoice_A_System_3.9.zip

SHA256: 8332d91619563e46e248f427cf489f8bd61a83124eb4c95749ce284b443a2803

filename: downloader-script-takeout-v1.1.zip

SHA256: 8412f2d2b47181f272b0c0e02fe619331e0c2c8d3b90f32e8ce08ac98aaec3f6

filename: downloader_takeout_script_v3.8.zip

SHA256: b781102c6ff857fb45089a6b3d30c5ebb7699ec7e8771bfa0039bef28de782bd

filename: takeout-downloader-script-galvanocauterization.zip

SHA256: 13dc7623c66d1fed51ae94b0d96e8ed45c93d893afabf9aceb4ef0a8da0243ee

filename: Void-v-Tools-v1.7.zip

SHA256: 841d0c25137f35b60d940705ab7b5dc3e9936f37e0561934e72c5dafe93466d8

filename: Resource-Canva-2.2.zip

SHA256: ac6a24d02209df94f56f67e7f3f19dc997f7a2625b91add1dd10cdec0a06d392

filename: for-clash-windows-3.2.zip

SHA256: 036062622f3a1fa2718afc91f8fe4edc693b757365dfc2c0958b70fe8c84c20d

filename: wire-ctx-2.6-alpha.1.zip

SHA256: db0640eb414a89bb62953f0aa7603557f3b8de515e7c3696156abc10f835ecef

filename: location-tracking-tool-phone-number-v3.3.zip

SHA256: 3fc5816afde3e58bf9fcaa1b3873f2d4bc8629ee7a8341a4a4979d2729cad5e6

filename: location_number_tracking_tool_phone_v2.5.zip

SHA256: 398ea394f9a4242ebe9fd67a5ca62445fc4a34b1731d4f99b8eea5e65a98ddcb

filename: tracking-tool-location-number-phone-3.2.zip

SHA256: b6e81d95c0c336e8b8bde3889f4df4ee17639f6ff055c631de19cab3c7efb63b

filename: Offline_LLM_Portable_v2.1-alpha.1.zip

SHA256: 1313b6cfb1ea43367fdd845f64526b4972a3a345bb8b13cef7ebb678d59b5f55

filename: ci_cd_xdev_v2.3-alpha.3.zip

SHA256: ed1ae6799ecb1fc7c5239c4ab95b3b9de9462f21219f144a25b91b6fd430a2c2

filename: farm-cdp-qq-auto-1.1.zip

SHA256: 6145aeacba6533e10dcea287d0fff64c48a790c58ae266ed18ea5d13c36d27ca

filename: v3.9.zip

SHA256: a0dd4924bec9bc077b1f98ddcb45b4e07b01e63ad703c2507d822b5b5130a077

filename: Software-Lithodes.zip

SHA256: 40c2b7b8dcfa6bfe0a199af9ea4baa00a4b8ecd73afa326702cdc4197d64bdef

filename: model-multi-router-v3.5-beta.1.zip

SHA256: 152929ae778e6ed9f358ca8590d2155e1a04137b109a5442891e1ba3fe1a7f82

About MistEye

MistEye is a proprietary Web3 threat intelligence and dynamic security monitoring platform developed by SlowMist, providing API-based detection of malicious activities and supply chain risk alerts for open-source package ecosystems.

All malicious packages and IOCs involved in this campaign have been integrated into the MistEye threat detection engine. Developers can use the API to automatically scan project dependencies, quickly determine if any known malicious packages are present, and receive remediation recommendations.

📖 API Documentation: https://app.misteye.io/api-docs

🛠️ MistEye-DepScan: https://github.com/slowmist/MistEye-DepScan

A lightweight CLI tool that scans project dependencies and globally installed packages for known malicious packages, supporting the npm, PyPI, Cargo, Go, and RubyGems ecosystems.

🛠️ MistEye-Skills: https://github.com/slowmist/misteye-skills

AI Coding Assistant Security Skills Pack automatically triggers MistEye security detection before dependency installation and URL access.

🛠️ MistEye-DNS-Guard: https://github.com/slowmist/MistEye-DNS-Guard

DNS security protection tool that detects malicious domains and risky access, identifying threats such as phishing and C2.

This article was written by the SlowMist Threat Intelligence Team, leveraging the MistEye Threat Intelligence System and SlowMist Agent AI for analysis. Feel free to reach out with any questions or feedback.

[1]https://x.com/OpcodeIntel/status/2091578565628502324

[2] https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/

[3] https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html