NullReceiver · reviewed repository evidence

Follow the connections

Identical file hashes connect 700 repositories in the content register. Pinned task, wallet and normalized-body relationships remain separately documented in the 124 detailed cases.

700repositories in the content register
15distinct reviewed SHA-256 hashes
124detailed repository cases

Identical content across the register

Each group shares exact file bytes. Its occurrences may have different repository context or verification depth. Select a hash to inspect every matching record.

134 repositories1807c89ee2801bc7756ad8b8f7fe0c2bea23342ed3b3eb0b7febe656bc8875fe134 file versions →121 repositoriese2d35f05df843340e12b68dbac1d071034542a2b2111ebaead355b4c67e5ce8b121 file versions →117 repositoriesb4e42a13556db646b97c3b683fca3b43eb3f01f9fa3fcea3a46a7ce20a6aaab6117 file versions →107 repositories011f6842382c4d4fd371f6db91ff5da65a6c038529dc19dbb65ef81942b102d5107 file versions →103 repositories3287f2de563bd76465d353bd22b4d07c2af1cda9dd45efcb0da49e3ca49f7639103 file versions →100 repositories2c110c766b10ba9a9d49f93dd52d0b75186f142fe81541c3fdb7ee1849f90317100 file versions →10 repositories80f7baa8585881382f98e0f133327aa61e33f21d663839e296966075db75e29e10 file versions →3 repositories4a0bf8b3274b281b099d11ac4c94e99314d75f4007681b6b9400d647ba261c6d3 file versions →

Detailed-case relationships

This graph covers the 124 pinned cases. Expand a value to inspect its source in each repository. A repository owner is not identified as a threat actor.

wallet0xa322e5f3d311d3080e6f0121063e9adc2490ef1a124 repositories

Loader sender reference

Known public indicator; repeated content does not establish owner identity or observed traffic.

git_blob1a828db96e870c5db15b61f9e82f515cbb26f4c3107 repositories

Identical automatic-task bytes

Task and payload evidence must be interpreted together.

normalized_loader28cd59635442295787686b6d2a2f1f4f620eec28dc80279aa887824245f91ead84 repositories

Shared normalized loader body

Normalization is not a proof of semantic equivalence.

sha256011f6842382c4d4fd371f6db91ff5da65a6c038529dc19dbb65ef81942b102d554 repositories

Identical file bytes

sha256e2d35f05df843340e12b68dbac1d071034542a2b2111ebaead355b4c67e5ce8b23 repositories

Identical file bytes

normalized_loaderaf13abc155aa1cd6cc102605b69f43d36926e8a2c029250ce36fedcfc4f2a55620 repositories

Shared normalized loader body

Normalization is not a proof of semantic equivalence.

sha256b4e42a13556db646b97c3b683fca3b43eb3f01f9fa3fcea3a46a7ce20a6aaab614 repositories

Identical file bytes

git_blob2e3b6463029f5039ad840fdefb796333446fc76413 repositories

Shared editor configuration

A correlation pivot, not a standalone malicious-file verdict. These files can contain otherwise legitimate settings.

git_bloba5177abe1a03fb01906b2deb0bdfcc3201e8c83213 repositories

Shared editor configuration

A correlation pivot, not a standalone malicious-file verdict. These files can contain otherwise legitimate settings.

git_blob934d55548c36ff0e330f2a2ba69bf74b10a7dcba13 repositories

Shared editor configuration

A correlation pivot, not a standalone malicious-file verdict. These files can contain otherwise legitimate settings.

git_blob51b1974952958055878c8531202048c561c6f3a213 repositories

Shared editor configuration

A correlation pivot, not a standalone malicious-file verdict. These files can contain otherwise legitimate settings.

sha25680f7baa8585881382f98e0f133327aa61e33f21d663839e296966075db75e29e10 repositories

Identical file bytes

git_blob5e226620d2e360205cc8634e3c581a008d3825618 repositories

Identical automatic-task bytes

Task and payload evidence must be interpreted together.

sha2561807c89ee2801bc7756ad8b8f7fe0c2bea23342ed3b3eb0b7febe656bc8875fe6 repositories

Identical file bytes

sha2562c110c766b10ba9a9d49f93dd52d0b75186f142fe81541c3fdb7ee1849f903174 repositories

Identical file bytes

normalized_loaderddef11091e8f15d5729758b1bd9653428ff776acb8994223185be8ed855c74744 repositories

Shared normalized loader body

Normalization is not a proof of semantic equivalence.

sha2564a0bf8b3274b281b099d11ac4c94e99314d75f4007681b6b9400d647ba261c6d3 repositories

Identical file bytes

git_blob6ed9e10004ff206e18497b03a938b7176981a2de3 repositories

Identical automatic-task bytes

Task and payload evidence must be interpreted together.

sha2563287f2de563bd76465d353bd22b4d07c2af1cda9dd45efcb0da49e3ca49f76393 repositories

Identical file bytes

normalized_loader69dfc5fd4fcc839eae406bd232e9eb0a80bf1f2fbbf069b57773fc9be0273fad3 repositories

Shared normalized loader body

Normalization is not a proof of semantic equivalence.

Wallet → advertised infrastructure

Infrastructure observations are separate from loader observations. We decoded public transaction records without contacting the advertised addresses.

Dated publication

193[.]247[.]144[.]38

A dated wallet publication, not verified server reachability or proof that every loader selected this transaction.

Transaction time
2026-09-06T21:28:35Z
Observed at
2026-09-06T21:45:00.5645436Z
Method
First eight recipient bytes decoded as two IPv4 values; both equal
Public explorer evidence ↗

Shared services are context

These legitimate RPC and explorer services appear in the resolver. Their presence alone does not link projects to this campaign, and they are not presented as attacker-owned infrastructure.

1rpc.ioeth.drpc.orgethereum-rpc.publicnode.cometh-mainnet.public.blastapi.ioeth.blockscout.com

Repository evidence and version history →Download correlation data ↓How collection works →