TF-MAL-js.minijs
📛 Threat Title
Malware family: MiniJS
Description
ThreatFox malware family `js.minijs`. Printable name: MiniJS.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
js.minijs
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.minijs
IOC database
- Type
- domain
- Value
js.minijs- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-js.minijs
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.minijs
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:borecraft.com
Framing note: this bulletin covers the May 11-12 wave specifically. The broader Shai-Hulud / Mini Shai-Hulud family has been running since September 2025 (Trivy compromise, original SAP CAP wave, Bitwarden CLI, Lightning PyPI).
-
web:fossa.com
See technical details of the latest mini-Shai-Hulud supply-chain attack, including affected packages and remediation strategies.
-
web:github.com
Mapping Malware with MITRE ATT&CK is a detailed research project focused on analyzing malware threats using the MITRE ATT&CK framework. The project investigates Ryuk Ransomware, a notorious malware family , identifying its characteristics, motivations, and potential targets - MojithaR/Mapping- Malware -with-MITRE-ATT-C
-
web:malpedia.caad.fkie.fraunhofer.de
MiniJS is a very simple JavaScript-based first-stage backdoor. The backdoor is probably distributed via spearphishing email. Due to infrastructure overlap, the malware can be attributed to the actor Turla. Comparable JavaScript-based backdoor families of the actor are KopiLuwak and IcedCoffee.
-
web:windowsforum.com
The emergence of RESURGE signals more than just another entry in a long line of malware threats. According to CISA, RESURGE contains advanced persistence features inherited from the SPAWNCHIMERA malware family—a group notorious for its ability to survive system reboots and avoid simplistic remediation .
-
web:www.breachsense.com
Malware incident response is the coordinated process of identifying, containing, eradicating, and recovering from malware infections. It includes isolating infected systems, analyzing the malware's behavior, remediating affected accounts, and implementing controls to prevent reinfection.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.cryptotimes.io
Mini Shai Hulud Malware Targets Crypto Wallets via npm Packages The worm specifically targets cryptocurrency wallet files along with cloud credentials, SSH keys, and npm tokens, exfiltrating stolen data through the victim's own GitHub account.
-
web:www.ncsc.gov.uk
This guidance helps private and public sector organisations deal with the effects of malware (which includes ransomware). It provides actions to help organisations prevent a malware infection, and also steps to take if you're already infected. Following this guidance will reduce: the likelihood of becoming infected the spread of malware throughout your organisation the impact of the infection
-
web:www.tenable.com
Mini Shai-Hulud is a self-spreading supply chain worm targeting npm and PyPI. Here's what you need to know about the attack, affected packages, and remediation
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.