D🦇

just a chill devvv | @0xCrypticCrypto @nipmod

[D🦇 @_ditro]

This is the reality of npm today.
@nipmod adds the missing trust layer so agents don’t execute compromised packages

[Microsoft Threat Intelligence @MsftSecIntel]

Compromised npm packages ([email protected], [email protected]) are abusing Hugging Face repos as exfiltration infrastructure. The packages deploy a remote access trojan (RAT) that captures keystrokes, screenshots, and crypto wallet credentials.

Indicators of compromise (IOCs):
- npm user: hexalpha10 / author: toskypi
- 195.201.194[.]107:8010 (WebSocket C2)
- c2-toskypi.onrender[.]com (HTTP C2)
- huggingface[.]co/api (exfiltration endpoint)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftSystem64 (persistence)
- MicrosoftSystem64.service (Linux systemd persistence)
- \MicrosoftSystem64 (Windows scheduled task)
- MicrosoftSystem64/payload.js (payload directory)

Defenders: treat unexpected huggingface[.]co/api calls from non-ML workloads as suspicious.

[Nipmod @nipmod]

This is exactly why we’re building Nipmod

Software discovery needs a trust layer before execution, for humans AND for AI agents. Exact package version, install hooks, provenance, risk signals, approval boundary.

@MsftSecIntel happy to compare notes

https://t.co/lM4xDkJkZx

[D🦇 @_ditro]

Excited to be part of @nipmod @hazarxyz

I’m going to help make AI agents operate much more securely, especially when it comes to packages, dependencies, and the execution of external code.

[Nipmod @nipmod]

Welcome @_ditro to Nipmod!

He will focus on security infrastructure, including safe code execution, sandboxing architecture, latency optimization, and privacy / zero-knowledge research.

He brings backend experience across automation, infrastructure optimization, and secure environments.

Step by step, we are bringing in the right people to build Nipmod into something that matters.