A Scanner That Scans You: Inside the npm @intentsolution/database-security-scanner Downloader
A package published to npm under a trustworthy security name is an obfuscated dropper. We analyzed every layer with our research engine, from a custom-alphabet base64 decoder to a scrambled C2 address and a payload daemonized into ~/.vscode.
15 Jun 20265 min read
