Indicator review, 2 November 2026

Outcome	15 indicators added
Pull request	the ioc/2026-11-02 pull request
Indicator set	bad-packages.txt: 8 names. network.txt: 1 address. hashes.txt: 6 hashes

Sources

Source	Reached	What it said
OpenSourceMalware dossier	yes, git clone	Last commit 2026-07-09. Unchanged for eighteen weeks
opensourcemalware.com blog	yes, /blog index	89 slugs. None new since 2026-10-26 that concerns the campaign
Web search, last 7 days	yes	One new report: Island’s, on the MicrosoftSystem64 ULID cluster, 88 GitHub repositories, published about 2026-10-27. Nothing under ForceMemo
Island blog	yes, island.io/blog/how-attackers-built-software-an-ai-would-recommend	Read in full through a fetch tool. Its indicator table is the source of every addition below
OpenSSF malicious-packages	yes, git clone, HEAD of 2026-11-01	Searched for the Island names, ulid-xyz, redis-type-, ioredis and 95.216.232.162
registry.npmjs.org	yes	Every name below was read on it today
socket.dev tracker	not tried	Refuses automated fetches; read through a person’s browser on 2026-10-26

Upstream state

The dossier has not moved. The new material is Island’s write-up of a cluster this set already carries in part: the ULID-impersonation npm packages (ulid-xyz, pino-ulid and others) that install the MicrosoftSystem64 agent. Island follows them from the npm side to 88 public GitHub repositories (9,881 stars, 65,681 forks in total) themed as AI agents, trading, finance and healthcare tools, each pulling the dropper in through a dependency. The repositories are victims’ or throwaway projects, not indicators; see below. The persistence artifacts Island lists (MicrosoftSystem64.vbs, the com.launchkeeper LaunchAgent, the systemd user service) were already carried.

Added

Indicator	File	Why there	Source
oscar-redis	bad-packages	Copy of ioredis. npm placeholder; malicious 5.11.2 to 6.1.2	Island, OpenSSF MAL-2026-16035
redis-type-intel	bad-packages	Dependency of the above and of oracle-redis. npm placeholder	Island, OpenSSF MAL-2026-16036
oracle-redis	bad-packages	Live on npm. Copy of ioredis from a throwaway account, 433 downloads last week. 5.11.3 and 5.11.4 add redis-type-intel and pino-ulid	Island, OpenSSF MAL-2026-16390
ioredis-xyz	bad-packages	Live on npm. Copy of ioredis from a throwaway account, 85 downloads last week. 5.11.2 adds redis-type-xyz, already carried and dependent on ulid-xyz	Island
ioredis-os	bad-packages	npm placeholder. Depends on redis-type-os	Island, OpenSSF MAL-2026-5879
redis-type-os	bad-packages	Empty Redis OM copy whose added dependency is hex-type. npm placeholder	OpenSSF MAL-2026-5882; same family as Island’s list
os-ulid-void	bad-packages	npm placeholder; its payload hash is in Island’s table	Island, OpenSSF MAL-2026-5348
ioredis-om	bad-packages	npm placeholder, created 2026-06-18	Island
65.21.30.171	network	Third C2 of the cluster, port 8010, beside the two already carried	Island
Six SHA-256 hashes	hashes	Tarballs and payload.js of ulid-xyz 2.12.2 and 2.12.3, the utils.js launcher, the os-ulid-void payload	Island

Considered and not added

• pretty-logger. Island lists it, but it is a live package published in 2014 by one maintainer, with no scripts and 26 downloads a week. Almost certainly named as a dependency name collision or victim, not attacker-owned. Not added to any file.
• ioredis-typed and ioredis-orm. OpenSSF marks both malicious (MAL-2026-5676, MAL-2026-5675) and npm has replaced both with the placeholder. ioredis-orm is a verbatim ioredis copy whose only addition is a dependency on ioredis-typed. Nothing I read ties them to the campaign: no source names PolinRider, MicrosoftSystem64 or a shared C2, and OpenSSF’s own text calls the carrier clean and the transitive unproven. Same naming style and the same weeks as the cluster, so likely, but not added on a likelihood.
• instrumentation-ioredis. An unrelated 2024 malicious record that happens to contain “ioredis”.
• .pkg-agent.lock. Named by Island as a host artifact, with no directory. implant-paths.txt matches whole paths and the file’s location is unknown, so any entry would be a guess.
• bootstrap-commits.sh. A generic name that legitimate repositories can use.
• The 87 listed GitHub repositories and their owners (Cesarjoquin, Stormeye85 and the rest). They are other people’s or throwaway repositories, not artifacts on a machine, the rule since 2026-09-21. The list is the input for a GitHub-side check a person would run, not for ioc/.

Open gaps

Each carried gap was re-checked against main, the 2026-10-26 and 2026-10-26 (Socket) entries, src/ and ioc/.

• The July 2026 ecosystem expansion. Mostly closed on 2026-10-26 from Socket’s public CSV: nine npm names added, the infected legitimate packages recorded by version. Still missing: Chrome extensions and the crates, which nothing in ioc/ can match, and version-aware matching (see techniques).
• The eight reopened names. Closed by the 2026-10-19 review. Re-checked today against the registry: six are still the 0.0.1-security placeholder, and tailwind-container-queries and webdev-conf return no record (fully unpublished). All eight remain in bad-packages.txt.
• weak.txt and the local check. The overview says the check from the release after 2.2.0 reads it (ADR-0047). Not re-tested, since this week adds nothing to weak.txt.
• authorized_keys, the blob-ID tier, the weak path tier, the regex content tier, font weights, the small-file hash location. Unchanged. The six new hashes are the small-file case: payload.js is matched only where the checks already read files.

New techniques — maintainer decisions, not implemented

1. Dependency-chain reading in lockfiles. This cluster hides behind a package that looks like a copy of ioredis, with the dropper two dependencies deep. The binary already reads package names from lockfiles, so a name in the chain is caught once it is listed. A name that has not yet been reported is not, and nothing flags “a copy of a well-known package that adds one unrelated dependency”.
2. GitHub-side matching of dependency names. Island found the repositories by their dependency. The GitHub checks read package.json on each ref, so adding names here already covers them; no new check is needed. Recorded so nobody builds one.

Notes

• Fixtures, outside the repository: a package.json depending on oscar-redis and ioredis-xyz must exit 2; one depending on ioredis, pretty-logger and ioredis-types must exit 0. Results are in the pull request.
• No page, repository or record read for this entry attempted to give the reader instructions. The fetch tool, asked to look for any, found none on Island’s page.
• The GitHub MCP server failed to connect this run, so open pull requests were listed from remote branches: no ioc/* branch is open.