Four Doors Into Your Build This Week: A Terraform Registry, a Hijacked Release Pipeline, a Resurrected GitHub Action, and a Placeholder Domain. Here Is What Our Feed Had Behind Each One.
Four supply-chain stories landed between September 22 and September 25, and every one of them walked in through a door most shops do not watch. A package registry nobody scans. A release pipeline that handed its own publish token to an attacker. A GitHub Action that had been dead since May and came back to life on its own. And a domain that exists in 1,700 repositories only because somebody needed a fake hostname for an example.
We checked each one against our own corpus before writing a word. The scorecard is mixed, and we are printing all of it.
Door one: the Terraform registry is now a malware channel
Oliver Smith at Aikido published on September 22 the first case we know of where the HashiCorp Terraform registry itself was used to deliver malware. Two providers, gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads, one letter off the long-standing kreuzwerker/docker), pull two Go modules served from attacker-registered vanity import paths: gocommunity.io/orderedbtree, first published August 11, and gogets.dev/btreex, first published September 8.
The implant uses an Arbitrum Sepolia smart contract as a dead drop and Slack workspaces as its command channel, polling conversations.history every ten seconds. Aikido ties it to Graphalgo, the fake-Web3-job campaign ReversingLabs attributed to North Korean operators in February. The Hacker News also rounded up a parallel npm cluster from Checkmarx, JFrog, and SafeDep.
Door two: MemTensor's own release pipeline shipped the stealer
The SafeDep team reported on September 23 that an attacker pushed commits to MemTensor's GitHub repositories that made the release job hand over its npm and PyPI tokens before it published anything. The result was @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23 and 0.1.25 on npm, and MemoryOS 2.0.34 on PyPI, all carrying a Go implant called sckit that steals cloud, registry, and source-code credentials and spreads itself by publishing again with whatever tokens it finds. The clean versions to pin are 0.1.20 and 2.0.33. Command and control sits under skyleen.fr and its subdomains.
Door three: a dead GitHub Action came back to life
Karlo Zanki at Socket reported on September 24 that actions-cool/issues-helper and actions-cool/maintain-one-comment, both compromised in the May Mini Shai-Hulud wave and disabled by GitHub on May 19, became accessible again on September 16 between 09:09 and 16:16 UTC. Nobody had cleaned the malicious commit out. Every workflow that referenced either action by a version tag pulled the May 18 payload on its next run. The issues-helper action alone has about 15,000 dependent repositories. GitHub disabled both again on September 25. Nobody has said publicly why they came back.
That is the same shape we measured four days earlier in the MCP registry: a package deprecated, then quietly restored, with the consumer never asked to re-approve it. "Disabled" is a state, not a fix. If the bad commit is still in the repository, the takedown is a nap.
Door four: the placeholder answered
Ax Sharma and Cody Nash at Manifold Security, writing on Bromure on September 23, found that third-party.com, a domain developers type into documentation, test fixtures, MCP server docs, and AI agent skills when they need a hostname that looks fake, has served a fingerprinted fake Cloudflare check since June. Windows visitors are told to paste a PowerShell one-liner that fetches and runs a script from elxxvvx.xyz. BleepingComputer counts it in 1,500 files across 1,700 repositories, including Chromium, Vercel, and Sanity.
The domain was registered in 1996 and nobody hijacked it. Somebody owns it and is operating it. The only placeholders that can never do this are the IANA-reserved ones: example.com, example.net, and example.org.
What our feed had behind each door
We looked before we wrote. Here is the honest version.
MemTensor was a clean miss. Our deny-list returned allow for both named packages, and neither skyleen.fr nor any sckit hash was in our corpus. We are adding the two packages as version-scoped entries, the C2 apex and seven subdomains, and seventeen hashes.
The Graphalgo npm cluster was mostly held, and the credit is not ours. Six of the eight packages we could check were already on the deny-list: mathmain, mathsbase, math-universe, indexed-btree, modern-events, and graphlib-js. They got there through OSV's malicious-package feed, which we redistribute. graphcore-js was a miss. We ran out of lookups before checking crypto-hasher, events-router, and sort-btree, so those are unknown, not clean. We are deliberately not adding quick-events, which the roundup named: it pulls over nine million downloads a month, and a list entry with no version is not enough evidence to block that for everyone.
The Terraform providers expose a structural blind spot. Our package deny-list covers npm and PyPI. It has no Terraform ecosystem and no Go modules, so there was nothing for it to hold. We are feeding the two vanity domains and the payload hashes to the blocklists. The dead-drop contract address goes in the MISP feed as a non-blocking attribute, because no CSV blocklist has a type for a wallet. We deliberately left the two attacker Slack workspaces out of the feed: they are hostnames on slack.com, and any tool that trims entries down to the registered domain would turn them into a block on Slack itself. Covering the registries themselves is a gap we are naming, not one we closed today.
The resurrected Actions left us nothing to feed. Socket's update names repositories and a commit, not network indicators. An action reference is not a blocklist type.
third-party.com and elxxvvx.xyz were in our index since July 14, arriving through ThreatFox at confidence 70. That is 71 days before the Manifold write-up, and it is ThreatFox's catch, not ours. It is also not a win, because confidence 70 sits below the floor our own edge shield blocks at. We held the record and did not act on it. We are raising both to the confidence the Manifold evidence supports and citing Manifold. The SafeDep second-stage IP, 193.247.144.38, is the same story: in our index since September 4 via TweetFeed, also at confidence 70. We raised it to 85 on SafeDep's evidence.
What to do about it on Monday
Pin GitHub Actions to a full commit SHA, not a tag. A tag is a name the owner can point anywhere, and this week proved that a repository GitHub disabled can come back pointing at the same bad code.
Search your repositories, documentation, test fixtures, and agent skills for third-party.com and any other placeholder you do not own, and replace them with example.com. Then block third-party.com and elxxvvx.xyz at DNS. Nothing legitimate lives there, so blocking costs nothing.
If you run Terraform, audit your required_providers blocks for any namespace you did not choose on purpose, and check the spelling of kreuzwerker in particular. Mirror providers internally if you can.
If anything in your environment installed @memtensor/memos-cloud-openclaw-plugin 0.1.21, 0.1.23, or 0.1.25, or MemoryOS 2.0.34, treat that machine or CI runner as compromised and rotate every token it could read. Block skyleen.fr and every subdomain.
And look at how your release job holds publish tokens. MemTensor did not lose theirs to a phishing email. The attacker's commit asked the pipeline for them and the pipeline said yes. Trusted publishing with short-lived OIDC credentials, and a required review on workflow file changes, closes most of that door.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=four-doors-into-your-build-this-week-a-terraform-registry-a-hijacked-release-pipeline-a-resurrect
Comments