noon-contracts Noon Protocol SDK RAT

SafeDep: noon-contracts poses as a Noon Protocol SDK. On install it
exfiltrates SSH keys, crypto wallet private keys, and AWS credentials
including live STS.

Mapped techniques

T0136 Brandjacking
T0151 Installation scripts
T0184 Harvesting sensitive information from files

supply-chain campaign

T0136 · Initial Access · Brandjacking

Noon Protocol SDK impersonation.

T0151 · Execution · Installation scripts

Install-time exfil.

T0184 · Credential Access · Harvesting sensitive information from files

SSH, wallets, AWS STS.

Sources

https://safedep.io/malicious-noon-contracts-npm-defi-rat