← Remote Workers

https://jsonkeeper.com/b/BADC6

https://jsonkeeper.com/b/BADC6 is a payload URL that one published source reports in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ossprey. The report is dated 2026-07-02.

payload url Contagious Interview MATCHED IN SOURCE

First seen 2026-07-02 · last seen 2026-07-02

Source

• …very next day we detected another package, metrica-chain@2.4.5 [npm]; just like before, this one also fetched a second-stage payload from https://jsonkeeper.com/b/BADC6 . Then another, and another. We noticed that all of these payloads were being served by jsonkeeper with a short, non-sequential string…

  Uncovering a 300+ Package DPRK Contagious Interview Campaign — Ossprey · under “The Investigation” · published 2026-07-02 · pulled 2026-10-03

Find this indicator in the index, or see every payload URL this site holds under Payload URLs in the browse listing.

Related indicators

Cited by the same report: Uncovering a 300+ Package DPRK Contagious Interview Campaign

Ossprey lists 14 other indicators in this source. 12 are shown, chosen across types.

• ec26774218bc9ba577cab41f108138831165d891e83252cce231a542e797a0d3 file hash
• 146.70.253.107 IP address
• 216.126.225.104 IP address
• 216.126.225.83 IP address
• 23.227.202.244 IP address
• 38.92.47.175 IP address
• 38.92.47.85 IP address
• 45.43.11.199 IP address
• 45.59.163.198 IP address
• 45.61.150.31 IP address
• 5.253.43.122 IP address
• https://jsonkeeper.com/b/UPCMV payload URL

All 15 indicators from this source