Research Archive

Supply Chain Attack

Browse entries by research type, time, topic, and threat domain. This page behaves more like an archive than a feed.

2026

Over a near-black teal-blue background, a captured git bundle unpacks within intercepted network traffic as plaintext credentials and cryptographic material spill out intact and ungoverned by any redaction filter; the foreground shows a clean developer-tool facade concealing a background upload conduit dispatching the entire repository ahead of the model's inference call; the midground features a parallel conduit bypassing a security filter with raw sensitive data flowing unchecked through the ungoverned channel — copper-orange accents punctuate the scene, symbolizing the Grok CLI whole-repo upload reverse analysis
Security Research

Grok CLI Whole-Repo Upload Reverse Analysis: How a Single Prompt Ships Your .env to the Cloud

Triple cross-verified with IDA Pro, Frida, and mitmproxy, this post reproduces Grok CLI v0.2.98 uploading the entire codebase (including .env, RSA private keys, and other common dev-time secrets) verbatim and unredacted to xAI cloud storage via git bundle at the start of each turn. Compared against v0.2.93, the upload mechanism is identical across both versions, respect_gitignore defaults to false, and one of the 8 independent switches allows remote override.

2026-07-15 10 min #Sample Analysis

2025

Over a near-black teal-blue background, a weaponized legitimate analytics pipeline silently exfiltrates sensitive mnemonic data disguised as anomaly event fields; foreground: a dark door sprung open from a version-update package with copper-orange light leaking through the seams; midground: an APT silhouette straddling a multi-stage arrow staircase, a phased timeline, and a smoking trust-chain link; background: a leather wallet with glowing cracks and an anomalous cube hovering over a glass panel; corner: a copper-orange low-poly Trust Wallet shield logo — symbolizing the APT-level targeted supply chain attack that exfiltrated mnemonics via the PostHog channel in the v2.68 backdoor
Security Research

Trust Wallet Extension Backdoor: v2.68 Malicious Code Injection Analysis

In December 2025, Trust Wallet Browser Extension v2.68 was found to contain malicious backdoor code. The attacker modified the extension's source to exfiltrate users' seed phrases and private keys to the malicious domain metrics-trustwallet.com. This article dissects the malicious code and reconstructs the attack chain, concluding that this is an APT-level targeted supply chain attack.

2025-12-26 4 min #Supply Chain Attack
Over a near-black teal-blue background, a GitHub repo crowned with inflated Stars and Forks, a hijacked npm dependency URL in package-lock.json rerouting to a rogue package, and copper-orange exfiltration arrows flowing toward a C2 server — symbolizing the Solana trading bot supply chain attack on GitHub
Security Research

A Popular Solana Bot on GitHub Was a Wallet Thief: Supply Chain Attack Analysis

A malicious GitHub project disguised as a Solana trading bot lured developers with inflated Star and Fork counts, then exfiltrated wallet private keys by hijacking an npm dependency's download URL in package-lock.json. Full attack chain from discovery to deobfuscation and C2 exfiltration, spanning 29 malicious repos and 2 rogue npm packages.

2025-07-03 6 min #Supply Chain Attack

2024

Dark dossier of ISP home gateway and supply-chain contamination path
Security Research

CVE-2024-41992 Arcadyan FMIMG51AX000J RCE: ISP router supply chain bug

CVE-2024-41992 is a remote code execution vulnerability in the Arcadyan FMIMG51AX000J router firmware (used in WiFi Alliance EasyMesh certified devices), CVSS 9.8. An attacker triggers unauthenticated RCE through the web interface, impacting a large number of ISP-deployed home gateways globally. The firmware ships a hidden diagnostic page that calls system() with attacker-controlled parameters; that diagnostic path is reachable from the LAN management interface without authentication. Because the same firmware is re-branded by many ISPs, the blast radius is the entire supply chain: one firmware bug, hundreds of carriers, millions of household gateways.

2024-08-06 4 min #Vulnerability Analysis
Dark dossier of Git repo submodule and symlink compromise path
Security Research

CVE-2024-32002 Git submodule + symlink RCE: arbitrary code execution via git clone –recursive

CVE-2024-32002 is a Git RCE, CVSS 9.0, triggered by git clone –recursive. The attacker prepares a malicious repository: the submodule contains a malicious post-checkout hook plus a symlink pointing to the .git directory. When the victim clones it, Git executes the hook and achieves RCE. The attack abuses two cooperating features: submodules run their hooks on the parent repository's behalf, and case-insensitive filesystems on macOS let a symlink named .GIT point into the parent. The hook is then activated during the recursive checkout phase. The fix tightens submodule hook execution rules and the symlink handling. The lesson: a clone is not a passive read; the result it produces is a running system.

2024-05-15 5 min #Vulnerability Analysis

2020

ECC isomorphic curve bypasses Windows trust chain
Security Research

CVE-2020-0601 CurveBall: ECC Elliptic Curve Spoofing in Windows CryptoAPI

CVE-2020-0601 is a flaw in Windows CryptoAPI (Crypt32.dll) where the ECC certificate validator compares public-key coordinates but does not verify that the curve parameters themselves match the issuing CA, scored CVSS 7.8. The attacker constructs an isomorphic keypair against a trusted CA's public key and signs certificates that pass the entire Windows trust chain. Any application that calls into CryptoAPI — Edge, Outlook, IE, SMB signing, Authenticode, S/MIME — inherits the same blind spot, so the impact covers Windows 10 1709 through 1909 and Windows Server 2016/2019. The fix adds an explicit curve-parameter comparison in the chain validator.

2020-01-14 5 min #Vulnerability Analysis