Miasma/testmetest supply chain worm added forged, backdated commits to 12 GitHub repos on Nov 9, each instructing an AI coding agent to run an obfuscated 3.7MB scripts/setup.js. The CLAUDE.md file marked “DEVOPS-SEALED” tells the assistant not to read, quote or analyse the script, to run it without displaying output, and to run it automatically without confirmation.
Key points
12 GitHub repos were poisoned on Nov 9 with forged, backdated commits.
Each repo’s agent config points to an obfuscated 3.7MB scripts/setup.js.
Sources
filza-wq repackaged for stock iOS 27.0.x with system container access
filza-wq is a repackaged Filza file manager for stock iOS 27.0.x that can browse system containers normally inaccessible to App Store apps. It injects a dylib that uses the publicly documented worse_query sandbox-escape technique. The IPA must be re-signed with an App Groups entitlement to work.
Key points
Accessible Roots hub lists five targets including ConfigurationProfiles and System Data.
Dylib swaps Library/Caches for a symlink and consumes the sandbox token returned by container_copy_sandbox_token.
Sources
- Original post
- filza-wq - Linked page
sshole openssh on musl accepts any 257+ char password
sshole reports that openssh on musl accepted any 257+ character password for accounts with no password. The condition has existed since 2016. A proof-of-concept and patch are linked.
Key points
openssh on musl accepted any 257+ char password for accounts with no password
condition has existed since 2016
proof-of-concept and patch are available
Sources
- Original post
- check.sh - Linked in the post
- ktp.sh - Linked in the post
S5PIVOT – Python backconnect proxy uses scheduled task and sitecustomize
S5PIVOT reuses similar persistence to VIPERTUNNEL, using a numeric scheduled task, pythonw.exe from ProgramData, and a sitecustomize.py hook. The post lists three indicators to hunt for this tool.
Key points
Persistence: a numeric scheduled task.
Loader: sitecustomize.py in Lib loads the payload via runpy.
Sources
spillway Prompt-injection defense for tool-using agents announced
spillway is a prompt-injection defense for tool-using agents that uses structure to decide where agents act and a model to review refusals. It targets prompt-injection attacks on agents that use external tools.
Key points
Structure decides where agents act
Model reviews refusals
Sources
- Original post
- ktp.sh - Linked in the post
