eSentire Details DEV#POPPER and OmniStealer Supply-Chain Attack

Mar 6, 2026 · Original article ↗

Summary

eSentire’s TRU analyzed malware deployed through the ShoeVista GitHub repository, detailing DEV#POPPER and OmniStealer’s staged execution, persistence, and theft of developer credentials and cryptocurrency data.

Key points

Launching the weaponized ShoeVista repository triggered an obfuscated Node.js backdoor hidden in frontend/tailwind.config.js.
The multi-stage chain retrieved DEV#POPPER and OmniStealer payloads from command-and-control servers and blockchain transaction data.
DEV#POPPER used obfuscation and anti-analysis techniques, including RC4-encrypted strings, debugger disruption, and sandbox and cloud-environment checks.
The RAT could persist by injecting stager code into Node.js applications, including VS Code, GitHub Desktop, and Discord, across macOS, Windows, and Linux.
OmniStealer targeted browser and cryptocurrency-wallet data, Git credentials, system keychains, environment variables, and cloud-storage artifacts; collected data was archived and exfiltrated over HTTP or Telegram.
eSentire attributed the campaign with high confidence to a North Korean state-sponsored APT, citing shared TTPs; its analysts isolated the affected customer host.
eSentire released DEV#STOPPER.js and a YARA rule, and recommended auditing untrusted repositories, isolating development environments, and blocking crypto-network APIs used for staging.

Article Details

Attack Vectors: A weaponized GitHub repository named ShoeVista, disguised as an eCommerce project, triggered the attack when the victim launched its frontend.
The frontend loaded an obfuscated Node.js backdoor from frontend/tailwind.config.js, which fetched additional stages from C2 servers and decrypted and executed them.
DEV#POPPER retrieved its RAT source code from blockchain transaction data; its stagers also retrieved the OmniStealer payload from C2 infrastructure.
DEV#POPPER established persistence by injecting stager code into JavaScript files used by Node.js applications, including Visual Studio Code, GitHub Desktop, Discord, Cursor, and Antigravity.
DEV#POPPER and OmniStealer collected browser credentials and cookies, wallet data, Git credentials, keychain and credential-store data, clipboard contents, and environment variables, then archived and exfiltrated the data.
Defensive Notes: Block crypto-network APIs used by the threat actors for payload staging.
Verify repository authenticity and audit code from untrusted sources before execution; isolate development environments.
Use hardware wallets for cryptocurrency, store secrets in hardware security keys or password managers with strong 2FA, and do not store seed phrases on disk.
Implement phishing and security awareness training using real-world scenarios.
Use a 24/7 Managed Detection and Response provider for threat hunting and rapid response.

Indicators of compromise

Type	Indicator	Context
IPV4	`136[.]0[.]9[.]8`	Additional C2 address identified in DEV#POPPER samples.
IPV4	`198[.]105[.]127[.]210`	Campaign-specific C2 address selected by DEV#POPPER based on its campaign identifier.
IPV4	`23[.]27[.]20[.]143`	C2 and staging server used by Stage 2 to retrieve the next payload stage.
IPV4	`23[.]27[.]202[.]27`	Additional C2 address identified in DEV#POPPER samples.
URL	`hxxp[:]//23[.]27[.]20[.]143:27017/$/boot`	Specific C2 URL used by Stage 2 to retrieve the encrypted next stage.