Sysdig Reports marimo CVE-2026-39987 Exploitation and NKAbuse Deployment via Typosquatted Hugging Face Space

Apr 16, 2026 · Original article ↗

Summary

Sysdig researchers recorded exploitation of marimo CVE-2026-39987 and analyzed credential harvesting, database pivoting, and an NKAbuse variant delivered via a typosquatted Hugging Face Space. They recommend patching and behavioral hunting.

Key points

Sysdig reported 662 exploit events from April 11–14, 2026, including credential harvesting, reverse-shell attempts, DNS-based RCE checks, and pivots to PostgreSQL and Redis using exposed credentials.
Researchers observed an attacker use the typosquatted Hugging Face Space vsccode-modetx[.]hf[.]space to deliver a dropper and a previously undocumented NKAbuse variant named kagent.
The captured Go implant was UPX-packed and used the NKN blockchain for command and control; the dropper attempted persistence through systemd user services, crontab, or macOS LaunchAgents.
Sysdig reproduced observed reverse-shell variants in a controlled environment and reported that existing runtime rules detected each tested variant, including through syscall-level behavior.
Recommendations include upgrading marimo to version 0.23.0 or later, hunting for kagent artifacts, blocking the typosquatted domain, rotating exposed credentials, and monitoring for NKN traffic.

Article Details

Attack Vectors: Attackers exploited CVE-2026-39987, a pre-authentication RCE in marimo, to run commands on exposed instances.
Operators extracted environment variables and files such as .env, docker-compose.yml, and SSH keys to obtain cloud credentials, database connection details, and API tokens.
Operators attempted reverse shells using bash, sh, Python, and netcat over TCP and UDP.
Attackers used harvested credentials to access and enumerate PostgreSQL and Redis instances.
An operator used a DNS query to bskke4.dnslog.cn for out-of-band RCE confirmation.
An attacker ran a shell installer hosted on the typosquatted HuggingFace Space vsccode-modetx.hf.space to deploy an NKAbuse variant.
The installer attempted persistence through a systemd user service, crontab @reboot entries, and a macOS LaunchAgent.
Defensive Notes: Update marimo to version 0.23.0 or later.
Hunt for ~/.kagent/, the kagent process, and kagent.service in systemd user directories.
Block vsccode-modetx.hf.space at proxy or DNS level.
Rotate credentials exposed to publicly accessible marimo instances, including DATABASE_URL values, AWS keys, and API tokens.
Monitor for NKN protocol traffic and the described reverse-shell and persistence behaviors.
Audit HuggingFace Spaces and AI/ML platform dependencies, and restrict access to verified publishers.
Deploy behavioral runtime detection for post-exploitation activity.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`bskke4[.]dnslog[.]cn`	DNS-log subdomain queried by an operator for out-of-band RCE confirmation.
DOMAIN	`vsccode-modetx[.]hf[.]space`	Typosquatted HuggingFace Space used to host the NKAbuse installer and payload.
IPV4	`111[.]90[.]145[.]139`	Observed exploit source focused on harvesting cloud credentials across multiple sessions; source IPs may be proxy or VPN endpoints.
IPV4	`120[.]227[.]46[.]184`	Observed exploit source that performed RCE verification with a unique echo token; source IPs may be proxy or VPN endpoints.
IPV4	`159[.]100[.]6[.]251`	Observed exploit source that attempted reverse shells and then accessed the PostgreSQL honeypot; source IPs may be proxy or VPN endpoints.
IPV4	`185[.]187[.]207[.]193`	Observed exploit source that performed basic RCE validation; source IPs may be proxy or VPN endpoints.
IPV4	`185[.]188[.]61[.]216`	Observed exploit source associated with filesystem browsing and access to /etc/passwd; source IPs may be proxy or VPN endpoints.
IPV4	`185[.]225[.]17[.]176`	Observed exploit source that attempted a Python-based dropper; source IPs may be proxy or VPN endpoints.
IPV4	`203[.]10[.]98[.]186`	Observed exploit source that used a DNS-log query for out-of-band confirmation; source IPs may be proxy or VPN endpoints.
IPV4	`38[.]147[.]173[.]172`	Observed exploit source that deployed the NKAbuse variant through the typosquatted HuggingFace Space; source IPs may be proxy or VPN endpoints.
IPV4	`45[.]147[.]97[.]11`	Observed exploit source associated with filesystem reconnaissance; source IPs may be proxy or VPN endpoints.
IPV4	`60[.]249[.]14[.]39`	Observed exploit source that performed a quick id probe; source IPs may be proxy or VPN endpoints.
IPV4	`92[.]208[.]115[.]60`	Observed exploit source that read .env files, docker-compose.yml, and SSH keys; source IPs may be proxy or VPN endpoints.
MD5	`bdcb5867f73beae89c3fce46ad5185be`	MD5 hash of the packed kagent NKAbuse payload.
SHA1	`049c35fa746a8b86c100bf6b348ef6163b215898`	SHA1 hash of the packed kagent NKAbuse payload.
SHA256	`25e4b2c4bb37f125b693a9c57b0e743eab2a3d98234f7519cd389e788252fd13`	SHA256 hash of the malicious install-linux.sh dropper.
SHA256	`27c62a041cc3c88df60dfceb50aa5f2217e1ac2ef9e796d7369e9e1be52ebb64`	SHA256 hash of the UPX-packed kagent NKAbuse payload.
SHA256	`f2960805f89990cb28898e892bbdc5a2f86b6089c68f4ab7f2f5e456a8d0c21d`	SHA256 hash of the unpacked kagent NKAbuse payload.
URL	`hxxps[:]//vsccode-modetx[.]hf[.]space/install-linux.sh`	Malicious installer URL used to deploy the NKAbuse variant.
URL	`hxxps[:]//vsccode-modetx[.]hf[.]space/kagent`	URL identified as hosting the UPX-packed NKAbuse payload.