T1078
Valid Accounts
discovered 2026-06-03Uses stolen GitHub credentials of the compromised owner (ocrybit) and the asteroiddao npm account to publish packages and poison repos.
View on MITRE ATT&CK
Uses stolen GitHub credentials of the compromised owner (ocrybit) and the asteroiddao npm account to publish packages and poison repos.
View on MITRE ATT&CK