Every result, accounted for.
The automatic-task search returned 100 files in 100 repositories. All 100 pinned trees contain the same task and one of six inspected payload blobs referencing the known NullReceiver wallet. Seven overlap the original 14 cases; the combined register has 124 repositories.
New: 125 results from the 400-font hunt, including four confirmed additions and unresolved findings → · Live collection status →
Observed 2026-09-07T00:15:55.107Z. These are content observations at specific commits. Current branch state, host execution, maintainer intent and prior reporting are separate questions.
Reproduce this search
path:.vscode/tasks.json "folderOpen" "eslint-check" "fa-solid-500.woff2"Open GitHub search ↗
The collector uses this REST form; pasting the browser path qualifier directly into REST returned zero during our check:
"folderOpen" "eslint-check" "fa-solid-500.woff2" filename:tasks.json
Six payload groups
| Tag | Repositories | Encoding | Payload Git blob |
|---|---|---|---|
| A11--* | 10 | XOR 201 | 4d73788ceb20a6ef9f70a303904f717d31b59c02 |
| A8-new*# | 53 | JS character escapes | 45f9ea105c3d52a3360d83a00e82249ff11b6fc9 |
| A11--* | 3 | XOR 201 | 7b35e1aec3565f38be5072aef66f6f4dfcf6a47d |
| A11 | 9 | XOR 162 | 15250703efa1a1698417d50287da068491ddfec6 |
| A8-new*# | 22 | JS character escapes | 7b12e8be75b18633bad1c3bde121356881b838d7 |
| A11--# | 3 | XOR 162 | 5e3a32e0fc4c570e0b622562da02e96bb8d21a1c |
All 100 matches
What the other counts mean
The earlier broad hunt recorded 793 indexed file hits across 615 repositories. That was a different set of queries, and most of it remains unreviewed. The automated queue changes as jobs run and deduplicates repeated file versions. None of these counts is a count of infected machines.
Download all query evidence JSON ↓ · Private queue and rule filters → · Combined reviewed register →
What is new in this dataset
This expansion adds 93 repository occurrences to our register. The wallet and NullReceiver mechanism were already public. Two additional byte hashes had no results in our exact web searches, but their differences are padding or a campaign tag; that does not establish a new technique or a globally unknown IOC.
The six blobs group into three bodies under explicit, limited comparisons: two pairs are identical after trimming outer whitespace; a third pair matches after the documented first-tag normalization. These comparisons describe source bytes, not full semantic equivalence. Prior-report checks for the additional repositories remain pending.