← Campaign register

NullReceiver.

Ethereum-backed payload resolution across developer repositories.

Updated Sep 11, 2026 (UTC) Reviewed snapshot · discovery hits stay private
700repositories with confirmed content
578file versions in the Sep 11 review
124earlier detailed cases
1known Ethereum sender

Following the simple marker queries adds 13 reviewed repository occurrences: eleven exact task targets and two requiring a case-insensitive filesystem. See the evidence and remaining leads → · OSM reporting status → · Collection status →

Search the evidence

Download complete register ↓

Search all 700 repositories by name, file path, marker or hash.

702 file versions · 700 repositories · Page 1 of 29
AaliyanAsif/AaliyanAsifpublic/fonts/fa-solid-500.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
b4e42a13556db646b97c3b683fca3b43eb3f01f9fa3fcea3a46a7ce20a6aaab6
Git blob SHA-1
15250703efa1a1698417d50287da068491ddfec6
Blob inspected (UTC)
2026-09-11T02:30:53.721Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

AAUConnectify/AAUConnectifyRepositorypublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
2c110c766b10ba9a9d49f93dd52d0b75186f142fe81541c3fdb7ee1849f90317
Git blob SHA-1
78a6265fd7386f7f65074cdb6fc8c39b2e226835
Blob inspected (UTC)
2026-09-11T02:30:46.487Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

Abdibaye/School_Management_Systempublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
2c110c766b10ba9a9d49f93dd52d0b75186f142fe81541c3fdb7ee1849f90317
Git blob SHA-1
78a6265fd7386f7f65074cdb6fc8c39b2e226835
Blob inspected (UTC)
2026-09-11T02:30:46.487Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

Abdul-Moiz31/Graphql-public/fonts/fa-solid-500.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
b4e42a13556db646b97c3b683fca3b43eb3f01f9fa3fcea3a46a7ce20a6aaab6
Git blob SHA-1
15250703efa1a1698417d50287da068491ddfec6
Blob inspected (UTC)
2026-09-11T02:30:53.721Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

Abdul-Moiz31/Journal-Apppublic/fonts/fa-solid-500.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
b4e42a13556db646b97c3b683fca3b43eb3f01f9fa3fcea3a46a7ce20a6aaab6
Git blob SHA-1
15250703efa1a1698417d50287da068491ddfec6
Blob inspected (UTC)
2026-09-11T02:30:53.721Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

Abdul-Moiz31/Machine-Learningpublic/fonts/fa-solid-500.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
b4e42a13556db646b97c3b683fca3b43eb3f01f9fa3fcea3a46a7ce20a6aaab6
Git blob SHA-1
15250703efa1a1698417d50287da068491ddfec6
Blob inspected (UTC)
2026-09-11T02:30:53.721Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

Abdul-Moiz31/SATechnicalOnboardingpublic/fonts/fa-solid-500.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
b4e42a13556db646b97c3b683fca3b43eb3f01f9fa3fcea3a46a7ce20a6aaab6
Git blob SHA-1
15250703efa1a1698417d50287da068491ddfec6
Blob inspected (UTC)
2026-09-11T02:30:53.721Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

Abdul-Moiz31/SideBar-Menupublic/fonts/fa-solid-500.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
b4e42a13556db646b97c3b683fca3b43eb3f01f9fa3fcea3a46a7ce20a6aaab6
Git blob SHA-1
15250703efa1a1698417d50287da068491ddfec6
Blob inspected (UTC)
2026-09-11T02:30:53.721Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

Abdulhaadi123/-CalcCraft-Crafting-Innovative-Solutions-with-Android-Development-public/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
1807c89ee2801bc7756ad8b8f7fe0c2bea23342ed3b3eb0b7febe656bc8875fe
Git blob SHA-1
5e3a32e0fc4c570e0b622562da02e96bb8d21a1c
Blob inspected (UTC)
2026-09-11T02:32:41.561Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

Abdulhaadi123/Abdulhaadi123public/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
1807c89ee2801bc7756ad8b8f7fe0c2bea23342ed3b3eb0b7febe656bc8875fe
Git blob SHA-1
5e3a32e0fc4c570e0b622562da02e96bb8d21a1c
Blob inspected (UTC)
2026-09-11T02:32:41.561Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

Abdulhaadi123/cosmetics-projectpublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
1807c89ee2801bc7756ad8b8f7fe0c2bea23342ed3b3eb0b7febe656bc8875fe
Git blob SHA-1
5e3a32e0fc4c570e0b622562da02e96bb8d21a1c
Blob inspected (UTC)
2026-09-11T02:32:41.561Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

Abdulhaadi123/food-histapublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
1807c89ee2801bc7756ad8b8f7fe0c2bea23342ed3b3eb0b7febe656bc8875fe
Git blob SHA-1
5e3a32e0fc4c570e0b622562da02e96bb8d21a1c
Blob inspected (UTC)
2026-09-11T02:32:41.561Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

Abdulhaadi123/TalkTidy-Python-Backendpublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
1807c89ee2801bc7756ad8b8f7fe0c2bea23342ed3b3eb0b7febe656bc8875fe
Git blob SHA-1
5e3a32e0fc4c570e0b622562da02e96bb8d21a1c
Blob inspected (UTC)
2026-09-11T02:32:41.561Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

Abdullah0332/randomvalue-jspublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
3287f2de563bd76465d353bd22b4d07c2af1cda9dd45efcb0da49e3ca49f7639
Git blob SHA-1
941dd7282dce8a2619b208559453277d61b6f041
Blob inspected (UTC)
2026-09-11T02:30:52.327Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

abdulrehmana28/flutter_login_uipublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
3287f2de563bd76465d353bd22b4d07c2af1cda9dd45efcb0da49e3ca49f7639
Git blob SHA-1
941dd7282dce8a2619b208559453277d61b6f041
Blob inspected (UTC)
2026-09-11T02:30:52.327Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

abdulrehmana28/medApppublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
3287f2de563bd76465d353bd22b4d07c2af1cda9dd45efcb0da49e3ca49f7639
Git blob SHA-1
941dd7282dce8a2619b208559453277d61b6f041
Blob inspected (UTC)
2026-09-11T02:30:52.327Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

abimtad/colabpublic/fonts/fa-solid-500.woff2Pinned commit

Malicious content verified at a pinned repository commit. See the detailed review for execution-route evidence and limits.

SHA-256
011f6842382c4d4fd371f6db91ff5da65a6c038529dc19dbb65ef81942b102d5
Git blob SHA-1
45f9ea105c3d52a3360d83a00e82249ff11b6fc9
Blob inspected (UTC)
2026-09-07T00:13:34.199Z
Repository verified (UTC)
2026-09-07T00:13:34.199Z
Reviewed
2026-09-07
Execution route
VS Code automatic task
OSM comparison
No OSM record at lookup · 2026-09-07T01:56:39.374Z

Pinned file evidence ↗Detailed review →

abimtad/TCP_chat-GoLangpublic/fonts/fa-solid-500.woff2Pinned commit

Malicious content verified at a pinned repository commit. See the detailed review for execution-route evidence and limits.

SHA-256
011f6842382c4d4fd371f6db91ff5da65a6c038529dc19dbb65ef81942b102d5
Git blob SHA-1
45f9ea105c3d52a3360d83a00e82249ff11b6fc9
Blob inspected (UTC)
2026-09-07T00:14:17.378Z
Repository verified (UTC)
2026-09-07T00:14:17.378Z
Reviewed
2026-09-07
Execution route
VS Code automatic task
OSM comparison
No OSM record at lookup · 2026-09-07T01:57:25.579Z

Pinned file evidence ↗Detailed review →

Abnet-Melaku1/Amazon-clonepublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
2c110c766b10ba9a9d49f93dd52d0b75186f142fe81541c3fdb7ee1849f90317
Git blob SHA-1
78a6265fd7386f7f65074cdb6fc8c39b2e226835
Blob inspected (UTC)
2026-09-11T02:30:46.487Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

abrshewube/kokebe_tsibah_frontendpublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
2c110c766b10ba9a9d49f93dd52d0b75186f142fe81541c3fdb7ee1849f90317
Git blob SHA-1
78a6265fd7386f7f65074cdb6fc8c39b2e226835
Blob inspected (UTC)
2026-09-11T02:30:46.487Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

abrshewube/laravel-ecommerce-projectpublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
2c110c766b10ba9a9d49f93dd52d0b75186f142fe81541c3fdb7ee1849f90317
Git blob SHA-1
78a6265fd7386f7f65074cdb6fc8c39b2e226835
Blob inspected (UTC)
2026-09-11T02:30:46.487Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

abrshewube/Spam-Email-Classificationpublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
2c110c766b10ba9a9d49f93dd52d0b75186f142fe81541c3fdb7ee1849f90317
Git blob SHA-1
78a6265fd7386f7f65074cdb6fc8c39b2e226835
Blob inspected (UTC)
2026-09-11T02:30:46.487Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

abshah2005/chatbotBEpublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
2c110c766b10ba9a9d49f93dd52d0b75186f142fe81541c3fdb7ee1849f90317
Git blob SHA-1
78a6265fd7386f7f65074cdb6fc8c39b2e226835
Blob inspected (UTC)
2026-09-11T02:30:46.487Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

abshah2005/Compiler-Project-Rehmanpublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
2c110c766b10ba9a9d49f93dd52d0b75186f142fe81541c3fdb7ee1849f90317
Git blob SHA-1
78a6265fd7386f7f65074cdb6fc8c39b2e226835
Blob inspected (UTC)
2026-09-11T02:30:46.487Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

Abubakarraza/nest-jspublic/fonts/fa-solid-400.woff2Historical file match

Reviewed malicious bytes matched to historical search results. The repository/path association was not freshly verified.

SHA-256
2c110c766b10ba9a9d49f93dd52d0b75186f142fe81541c3fdb7ee1849f90317
Git blob SHA-1
78a6265fd7386f7f65074cdb6fc8c39b2e226835
Blob inspected (UTC)
2026-09-11T02:30:46.487Z
Repository verified (UTC)
Not established by this review
Reviewed
2026-09-11
Execution route
Not established
OSM comparison
Not checked

Immutable blob metadata ↗

Content evidence, with limits. A pinned commit identifies a file in a repository tree. A historical match combines a recorded search association with shared blob inspection. Neither establishes current compromise, device execution or maintainer intent.

Old commit date. New branch content.

GitHub activity ↗

Seven branch versions of NifraWahaj/nasdaq-stock-intelligence-system retain the same parent, message and both commit timestamps: May 3, 2026 · 17:39:48 UTC. NifraWahaj is the repository owner's username, not a malware-family name. GitHub records six later force pushes. Comparing only the current commit with its parent would miss these replacements.

  1. Original push

    Original README commit

    No task or fake-font path in the complete tree.

    ca2fde31a7cc ↗
  2. Force push

    Task and script added

    799-byte task and 5,533-byte fake font. Older rmcej loader marker; wallet unresolved in this check.

    adaff1973651 ↗
  3. Force push

    Payload file emptied

    Task remains; referenced fake-font file is zero bytes. This is not a whole-repository cleanup verdict.

    0eb98f1e427a ↗
  4. Force push

    Wallet-linked payload introduced

    9,129-byte A8-*# loader in the same path, with the known Ethereum sender.

    5c3d87c5d66c ↗
  5. Force push

    A8-*#new: another encoded loader

    The 400-font blob grows to 31,303 bytes. Static inspection finds the A8-*#new marker and transport/execution tokens; wallet recovery remains unresolved.

    d04e36610ba6 ↗
  6. Force push

    A11--#: wallet recovered with XOR 243

    The 400-font blob changes to 27,414 bytes. Bounded literal decoding recovers the known sender wallet, A11--# marker and Ethereum resolver/transport tokens using XOR key 243.

    4a80c2486b95 ↗
  7. Force push

    Task changes from 400 to 500

    26,215-byte A11 loader; current inspected task references fa-solid-500.woff2.

    988e786183bd ↗

This verifies an empty-to-malicious payload transition in repository history. It does not prove a developer's machine caused reinfection. Legitimate rebases and migrations can also retain old commit dates.

Try the hunts yourself

GitHub Code Search

Searches return candidate files. Combine the task, payload and change history before deciding what the result means. See measured simple-query tests and the run() backtest →

Query 01

Automatic task → fake font

path:.vscode/tasks.json "folderOpen" "eslint-check" "fa-solid-500.woff2"

Find the inspected trigger template. Inspect the referenced file before confirming a case.

Query 02

Older font variant

path:.vscode/tasks.json "folderOpen" "fa-solid-400.woff2"

Covers the earlier path. Empty or missing payload files remain unresolved.

Query 03

Shared extension recommendations

path:.vscode/extensions.json "myml.vscode-markdown-plantuml-preview" "esbenp.prettier-vscode" "jebbs.plantuml"

Supporting template signal. Ordinary extension lists and research repositories also match.

Query 04

Push-artifact ignore entries

path:.gitignore "branch_structure.json" "temp_interactive_push.bat"

Found another wallet-linked loader; index misses are known. Filename case may differ.

Query 05

Plaintext wallet

"0xa322e5f3d311d3080e6f0121063e9adc2490ef1a"

Campaign-specific lead, including advisory and detection references. Obfuscated variants can be missed.

Query 06

Loader protocol combination

"X-Payload-B64" "eth_getTransactionCount"

Find the response-header fallback and Ethereum resolver together. Requires source-context review.

Query 07

JavaScript marker in font files

path:*.woff2 "global.i"

Broad discovery: 1,809 files reported in the September 7 test. Search matches remain candidates; use the query-test page for coverage and size partitions.

Query 08

JavaScript marker in 500-font targets

path:fa-solid-500.woff2 "global.i"

A simple filename and marker search. The REST equivalent reported 372 files; only the first page was retrieved in this experiment.

Code search indexes current default-branch content; it does not search force-push events or prove when a line was introduced. A known matching file was absent from one of our scoped searches. Empty results are inconclusive.

Candidate detection rules

Download YARA rules ↓

Content rules

Look for automatic interpreter-to-font execution, the known wallet alongside resolver calls, and the shared editing template. Rules identify candidates, including possible research references.

History correlation

Record GitHub's before/after commit IDs and push time. Compare both trees and client timestamps. YARA alone cannot detect a force push or fetch a GitHub repository.

Review before publication

Resolve the task's target, inspect it as text and verify the commit and hashes. Preserve missing files and errors. Unreviewed search hits are excluded from this public register.

YARA rules are starter candidates. See the accompanying rule notes for compiler validation and coverage limits. The website does not execute these rules against visitors' machines.

Rule notes and limitations →

What the evidence establishes

Campaign updates RSS ↗

Known technique

The sender wallet and NullReceiver mechanism were publicly documented before this research. Additional occurrences are not automatically new techniques or previously unknown compromises.

0xa322e5f3d311d3080e6f0121063e9adc2490ef1a

Safe collection

Public GitHub text, commit trees, recorded activity and existing third-party reports. No cloning, installing or executing suspect projects; no requests to decoded payload servers.

Coverage, not a success rate

The earlier search pass returned 793 file hits across 615 repositories. Twelve repositories were newly confirmed then, with NifraWahaj/nasdaq-stock-intelligence-system already reviewed. The task-query audits and marker-query follow-up bring the earlier detailed case set to 124 repository observations.

Scope: detailed commit evidence reviewed September 6–7 and additional immutable file content reviewed September 11, 2026 (UTC). Server reachability, endpoint execution and operator identity were not established. This page is a research register, not an automatic blocklist.