atomdrift lab - Fallout

SECTOR SURVEY since Aug 1 ⚛ feed

TODAY Tue Aug 4 · 7 catches · 0 waves · 3 singles

SC-816720-PDF1.js first seen anywhere script.wshscript.dropper javascript 8 hours ago

Obfuscated PowerShell dropper downloading malicious payload

@ruffle-rs/ruffle 0.5.0 javascript 14 hours ago

Purchase Order PO K 0158.js ✓ javascript 8 hours ago

Obfuscated code with dynamic function construction

YESTERDAY Mon Aug 3 · 26 catches · 0 waves · 3 singles

@bobfrankston/mailx-store-web 0.1.69 first seen anywhere http.report javascript 17 hours ago

@oh-my-pi/pi-coding-agent 17.2.5 staging.archiveexecution.wsh javascript 1 day ago

@cline/core 0.0.69 phishing.device-code javascript 1 day ago

SUNDAY Sun Aug 2 · 42 catches · 2 waves · 3 singles

🌊 statist-browser-typed-client-hra.workplacer.events 20.9.1 and 6 siblings dns.tunnelingdelivery.download-execute ✓ javascript 1 day ago

Dropper downloads and executes native payload

🌊 tinkoff-component-page-loader 20.8.2 and 2 siblings execution.native-binarydns.tunneling ✓ javascript 1 day ago

Trojanized library downloads and executes native payload

@openauthjs/openauth 0.4.3 first seen anywhere credential-theft.env javascript 1 day ago

google-closure-compiler-windows 20260527.0.0 loader.native-reflectrat.config javascript 2 days ago

google-closure-compiler-windows 20260730.0.0 loader.native-reflectstaging.encrypted javascript 2 days ago

SATURDAY Sat Aug 1 · 4 catches · 0 waves · 3 singles

fsevents 1.1.3 first seen anywhere hidden-payload.encodingwallet.desktop javascript 2 days ago

@a2a-js/sdk 1.0.1 dropper.download-execute javascript 2 days ago

@vercel/ncc 0.27.0 timing.timer javascript 2 days ago

That's every sector reporting. The full stream lives in the index →

javascript Fallout