Example Usage
┌─────────────────────────────────────────────────────────────────┐ │ ATTACK FLOW DIAGRAM │ ├─────────────────────────────────────────────────────────────────┤ │ │ │ 1. npm install 2. preinstall hook 3. Download │ │ ───────────────► ─────────────────────► ──────────────────► │ │ setup_bun.js Bun runtime │ │ │ │ 4. Execute payload 5. Credential theft 6. Exfiltrate │ │ ───────────────────► ──────────────────► ─────────────────► │ │ bun_environment.js TruffleHog scan GitHub repos │ │ │ │ 7. Self-propagate 8. Create runner 9. Destroy │ │ ────────────────────► ─────────────────► ─────────────────► │ │ Infect 100+ pkgs "SHA1HULUD" Wipe on failure │ │ │ └─────────────────────────────────────────────────────────────────┘
See also
dnsx
Open Source
Fast and multi-purpose DNS toolkit from ProjectDiscovery. Resolves domains, performs wildcard filter…
Nmap
Open Source
Kali
The industry-standard network scanner. Discovers hosts, open ports, services, OS versions, and runs …
cazador_unr
Free
[scanner] [TcpListener] [FileMiner] [Subscrabber]…
cbrutekrag
Open Source
Penetration tests on SSH servers using brute force or dictionary attacks. Written in C.…
agent-audit
Open Source
Static security scanner for LLM agents — prompt injection, MCP config auditing, taint analysis. 49 r…
o365spray
Open Source
Username enumeration and password spraying tool aimed at Microsoft O365.…