Trojanized fork martinez-polygon-clipping-tony

SafeDep: martinez-polygon-clipping-tony is a trojanized fork of
martinez-polygon-clipping. postinstall downloads a PyInstaller payload
and talks to Telegram.

Mapped techniques

T0129 Typosquatting
T0151 Installation scripts
T0172 Runtime backdoor

supply-chain campaign

T0129 · Initial Access · Typosquatting

Fork/lookalike of martinez-polygon-clipping.

T0151 · Execution · Installation scripts

postinstall PyInstaller dropper.

T0172 · Execution · Runtime backdoor

Telegram RAT.

Sources

https://safedep.io/malicious-martinez-polygon-clipping-tony-npm-telegram-rat