phantom-registry

Score Breakdown

Your Submission

{
  "evidence": "Primary evidence: (1) sandy-heron's audit timeline shows failed login attempts from IP 187.190.110.83 on Feb 10, followed by 'CONTRIBUTOR ELEVATED' and 'MAINTAINER ADDED BY SOCIAL ENGINEERING' events on Feb 11 from the same IP - classic credential phishing pattern. (2) Three packages flagged by security scanner (bow-test 1.1.3, surge-relay 3.2.5, reel-codec 7.3.3) contain identical malicious postinstall scripts that exfiltrate environment variables and hostnames to telemetry-cdn.sh/io. (3) crispy-lobster (compromised maintainer) published 2 of the 3 malicious versions - their normal activity uses IPs 180.161.169.114 and 72.177.156.32, but the malicious publishes suggest account compromise. (4) sandy-heron has 2FA disabled (twoFactorEnabled: false), making them an easy target and potential initial compromise vector. (5) IP 187.190.110.83 is the common thread - used for sandy-heron's suspicious activity and also associated with rocky-heron, stormy-heron, and rocky-otter who attempted publishes with postinstall scripts.",
  "methodology": "Investigation methodology: (1) Started with security/flagged endpoint to identify initial indicators (3 packages with suspicious postinstall scripts). (2) Examined each flagged package's version history to identify who published malicious versions - found crispy-lobster published bow-test 1.1.3 and surge-relay 3.2.5, while misty-octopus published reel-codec 7.3.3. (3) Retrieved suspicious patterns from audit DB revealing IP 187.190.110.83 shared by 4 actors and sandy-heron's unusual activity (night hours, failed logins). (4) Queried sandy-heron's full activity timeline revealing the smoking gun: failed logins from IP 187.190.110.83 on Feb 10, followed by 'CONTRIBUTOR ELEVATED', 'MAINTAINER ADDED BY SOCIAL ENGINEERING', and 'SIMILAR PACKAGE REGISTERED' events on Feb 11. (5) Cross-referenced IP 187.190.110.83 activity showing publish attempts by rocky-heron, stormy-heron, and rocky-otter with postinstall scripts. (6) Verified crispy-lobster's normal IP patterns (180.161.169.114, 72.177.156.32) to confirm their account was compromised for malicious publishes. (7) Confirmed misty-octopus has 2FA enabled and different login IPs, suggesting a different compromise vector or collaboration.",
  "attack_vector": "credential_phishing",
  "phantom_handle": "sandy-heron",
  "attack_timeline": [
    {
      "event": "bow-test 1.1.3 published by crispy-lobster with malicious postinstall script exfiltrating to telemetry-cdn.sh",
      "timestamp": "2026-02-08T12:00:00.000Z"
    },
    {
      "event": "Failed login attempt on sandy-heron from IP 187.190.110.83 (credential probing)",
      "timestamp": "2026-02-10T04:58:00.000Z"
    },
    {
      "event": "Second failed login attempt on sandy-heron from IP 187.190.110.83",
      "timestamp": "2026-02-10T05:43:00.000Z"
    },
    {
      "event": "Third failed login attempt on sandy-heron from IP 187.190.110.83",
      "timestamp": "2026-02-10T06:48:00.000Z"
    },
    {
      "event": "sandy-heron CONTRIBUTOR ELEVATED via social engineering from IP 187.190.110.83",
      "timestamp": "2026-02-11T02:46:00.000Z"
    },
    {
      "event": "sandy-heron MAINTAINER ADDED BY SOCIAL ENGINEERING from IP 187.190.110.83",
      "timestamp": "2026-02-11T05:44:00.000Z"
    },
    {
      "event": "sandy-heron SIMILAR PACKAGE REGISTERED from IP 187.190.110.83",
      "timestamp": "2026-02-11T05:54:00.000Z"
    },
    {
      "event": "surge-relay 3.2.5 published by crispy-lobster with malicious postinstall script exfiltrating to telemetry-cdn.io",
      "timestamp": "2026-02-11T12:00:00.000Z"
    },
    {
      "event": "sandy-heron added swift-otter as maintainer to splice-link from IP 187.190.110.83",
      "timestamp": "2026-02-12T04:35:00.000Z"
    },
    {
      "event": "reel-codec 7.3.3 published by misty-octopus with malicious postinstall script exfiltrating to telemetry-cdn.io",
      "timestamp": "2026-02-14T12:00:00.000Z"
    },
    {
      "event": "Security scanner flagged 3 packages with suspicious postinstall scripts",
      "timestamp": "2026-03-01T12:00:00.000Z"
    }
  ],
  "compromised_packages": [
    {
      "name": "bow-test",
      "compromised_version": "1.1.3"
    },
    {
      "name": "surge-relay",
      "compromised_version": "3.2.5"
    },
    {
      "name": "reel-codec",
      "compromised_version": "7.3.3"
    }
  ],
  "compromised_maintainer": "crispy-lobster"
}