CryptoSkope repository malware analysis, indicators of compromise, and local impact assessment

cryptoskope-malware-report.md

CryptoSkope Malware and Local Impact Report

Date: 2026-08-15
Local target: Redacted local clone path
Origin: https://bitbucket.org/0xenstechlab/cryptoskope.git
Commit: 538e965b429cb44edc1a0caf21b5b8697ba5a0df
Verdict: Confirmed malicious repository; unsafe to open as a trusted workspace, install, build, or run.

Executive summary

The repository contained two independent, confirmed arbitrary-remote-code-execution paths:

1. A hidden VS Code folder-open task executed an obfuscated Node loader.
2. The normal npm run dev / npm start path imported a module that downloaded JavaScript and executed it with eval.

Both paths used the same remotely mutable JSONBin record. Code delivered through that record would run with the privileges of the logged-in macOS user. The remote record was not contacted during this investigation.

The local clone was permanently removed immediately after this report was written and its absence was verified. Deletion removed the working tree and its .git database; it did not remove the upstream Bitbucket repository or any independent backup/APFS/Time Machine snapshot.

Confirmed malicious mechanisms

1. Hidden editor-triggered loader

• .vscode/tasks.json lines 12-30 defined a hidden background shell task.
• Line 16 invoked node .bolt/cancel.
• Lines 28-29 configured runOn: folderOpen.
• .vscode/settings.json lines 16-23 attempted to allow automatic tasks.
• .bolt/cancel was a 128,438-byte, single-line obfuscated Node program.

Static analysis of .bolt/cancel confirmed that it:

• imported child_process, filesystem, path, and OS modules;
• created ~/.npm/scoped_dir6760_<timestamp>;
• wrote a staged main.js;
• installed axios, request, and socket.io-client;
• fetched a JSONBin record;
• compiled and invoked res.data.record.result using new Function;
• included detached/background execution behavior;
• included a hidden PowerShell path for Windows.

This trigger would be blocked by VS Code Restricted Mode, but could fire when the folder was trusted or inherited trust from a parent folder.

2. Normal npm start path

• package.json line 7 defined dev:backend as node server/app.js.
• Lines 8 and 10 invoked that backend from dev and start.
• server/app.js line 2 imported server/middlewares/validator/index.js.
• The validator decoded the same JSONBin URL at lines 31-34.
• At module load, lines 116-122 fetched the remote record and executed record.result through eval.

Confirmed trigger commands included:

• npm run dev
• npm start
• npm run dev:backend
• node server/app.js
• node server/server.js

Indicators of compromise

Indicator	Value
Obfuscated loader SHA-256	f69425a9ddedebfa97657d003fdd68a26bd526584ec5a4108696d2f0605ee01c
Validator module SHA-256	145da2b45dd69b9c6954a049a9cd505f73c117654b9074dc126561dbb0b52ad3
VS Code task SHA-256	096b1394b4c213aa5a5b189d4f8404ec377272b936a84c2e39561c1ecb20f5ce
JSONBin identifier	6a69c1d1f5f4af5e29d078b1
Defanged endpoint	hxxps://api[.]jsonbin[.]io/v3/b/6a69c1d1f5f4af5e29d078b1
Staging-directory pattern	~/.npm/scoped_dir6760_*

Local execution assessment

No repository code, package lifecycle script, server, frontend, Python service, pickle model, .bolt/cancel, or downloaded payload was executed during the investigation. No dependencies were installed. The JSONBin endpoint was deliberately not contacted.

Immediately before deletion, inert OS-level checks found:

• no node_modules directory;
• no .next build directory;
• no Python virtual environment;
• no python_service/predictions.db runtime database;
• zero ~/.npm/scoped_dir6760_* staging directories;
• zero active processes matching the known loader/backend patterns;
• zero files containing the known JSONBin/staging indicators in the checked npm, shell-profile, LaunchAgent, LaunchDaemon, and user-configuration persistence locations;
• no matching cron entry.

Five open handles to the repository directory were identified as /Applications/ChatGPT.app/.../node_repl inspection workers. They were not running repository files or the malicious loader.

Assessment: The available evidence strongly indicates that the known malware triggers did not execute on this machine. This is not equivalent to a full forensic guarantee: the unknown second-stage payload was remotely mutable and could theoretically use unrelated indicators or remove its artifacts. A definitive compromise assessment would require endpoint telemetry, historical DNS/network logs, and full-disk forensic acquisition.

Possible impact if triggered

The downloaded JavaScript would execute as the local user and could, in principle:

• read or exfiltrate files accessible to that user;
• steal environment variables, API credentials, SSH keys, cloud credentials, browser/session data, or developer tokens;
• search for cryptocurrency wallet/browser-extension data and present fraudulent signature or transaction prompts;
• modify source code, shell profiles, editor configuration, or startup items;
• install persistence, additional malware, miners, ransomware, or remote-access tooling;
• tamper with builds and dependencies to compromise later deployments;
• use authenticated local services and accounts reachable from the machine.

These are capabilities enabled by arbitrary code execution, not claims that each action occurred. The clean indicator checks found no evidence that the payload ran.

Other serious security findings

• A CoinGecko Pro API key was committed in plaintext in app/api/market/route.ts; it should be revoked or rotated by its owner.
• FastAPI startup automatically used joblib.load on a committed 51,200,182-byte pickle. Pickle/joblib deserialization can execute arbitrary Python. The model hash was 27db89f562729f0255ff29993dff5ff4d58a2c3e77247082e55cb4e5937d9814; it was not loaded.
• The unauthenticated /scrape endpoint accepted arbitrary URLs, followed redirects, disabled TLS verification, and lacked private-address/response-size protections, creating an SSRF risk.
• CoinGecko HTML was inserted with dangerouslySetInnerHTML without sanitization or a Content Security Policy.
• A package-lock-only npm audit reported 64 vulnerable package nodes: 8 critical, 24 high, 14 moderate, and 18 low. The locked Next.js 15.3.2 version was covered by a React Flight RCE advisory.
• The npm lockfile lacked resolved and integrity for 999 of 1,154 versioned entries. Python requirements were entirely unpinned and unhashed.
• The ML model reported negative cross-validation R-squared values at all horizons, and parts of the DEX/dashboard displayed mock or misleading financial data. It should not be used for trading decisions.

Recommended follow-up

1. Do not reclone or trust this upstream repository unless the owner publishes a verified clean history and explains the compromise.
2. Revoke/rotate the committed CoinGecko Pro key.
3. If the folder was ever opened as trusted in VS Code, or any trigger command was run before this investigation, disconnect the host from the network and perform a full incident-response review; rotate credentials from a separate clean device.
4. Search other systems or clones for the hashes and indicators above.
5. Report the malicious commit and repository to Bitbucket/the hosting organization, preserving this report and commit ID as evidence.