Example Usage
┌─────────────────────────────────────────────────────────────────┐ │ ATTACK FLOW DIAGRAM │ ├─────────────────────────────────────────────────────────────────┤ │ │ │ 1. npm install 2. preinstall hook 3. Download │ │ ───────────────► ─────────────────────► ──────────────────► │ │ setup_bun.js Bun runtime │ │ │ │ 4. Execute payload 5. Credential theft 6. Exfiltrate │ │ ───────────────────► ──────────────────► ─────────────────► │ │ bun_environment.js TruffleHog scan GitHub repos │ │ │ │ 7. Self-propagate 8. Create runner 9. Destroy │ │ ────────────────────► ─────────────────► ─────────────────► │ │ Infect 100+ pkgs "SHA1HULUD" Wipe on failure │ │ │ └─────────────────────────────────────────────────────────────────┘
See also
public-skills-builder
Free
Generate Claude Code bug bounty skills from public HackerOne reports and GitHub writeups — 18 vuln c…
WADComs.github.io
Open Source
WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and the…
UltimateCMSWordlists
Open Source
📚 An ultimate collection wordlists of the best-known CMS…
deepce
Open Source
Docker Enumeration, Escalation of Privileges and Container Escapes (DEEPCE)…
brutas
Free
Wordlists handcrafted (and automated) with ♥…
afrog
Open Source
A Security Tool for Bug Bounty, Pentest and Red Teaming.…