Loading malware…
3 distinct techniques documented for this family, organized by ATT&CK tactic.
The StepSecurity threat intelligence team discovered that dev-protocol — a verified GitHub organization with 568 followers belonging to a legitimate Japanese DeFi project — has been hijacked and is now being used to distribute malicious Polymarket trading bots.
Has a dependent package ( bignum-ts ) that impersonates big.js ... Several npm packages follow “log” and “pino” themes ... in addition to variations of “big” and “number”.
The repo's package.json includes two typosquatted npm packages that look like legitimate libraries but pull in obfuscated malware as transitive dependencies: Chain 1: ts-bign → levex-refa ... Chain 2: big-nunber → lint-builder
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.