contagious-interview

Full static analysis of HyperHives macOS Rust infostealer — 571 decrypted config values, C2 infrastructure, DPRK/Contagious Interview attribution, YARA/Sigma rules, STIX 2.1 bundle, ATT&CK Navigator layer

Pre-clone GitHub repo scanner for malicious VS Code tasks, git hooks, and IOCs. Built after surviving a Lazarus Group recruitment scam.

Dossiers of developer-targeted malware campaigns delivered via fake-recruiter pitches. Each case has a master analysis plus copy-paste-ready artifacts for would-be victims, abuse desks, detection engineers, and researchers.

Detect and clean up after the PolinRider supply-chain campaign — GitHub organizations, personal accounts, and macOS/Linux/Windows machines. Shell only, dry-run by default.

Fast, safe Rust scanner that finds DPRK PolinRider / BeaverTail malware by reading files as data, never running them.

4-phase sandboxed code-review workflow for inspecting untrusted GitHub repos. Built after seeing recruiter scams target Web3 job seekers.

Detect fake-job-interview malware before it runs. safe-install scans npm repos for the Contagious Interview (DPRK) attack, checks sites for ClickFix clipboard hijacks, and guides incident response if your wallet or machine was already compromised. Built from a real forensic teardown.

PowerShell forensic toolkit for auditing Node.js development environments. Detects npm supply chain attacks, hidden task execution, and obfuscated malware processing.