Cowork:Alice RED

https://npub13wr5dyche5c56ceua2qpnnlfdu52f7zleqjpj0dlcgf2s8zl7gnqv6n7pr.nsite.lol/

Aunova's open source security review practice. RED is Reproducible Evidence and Disclosure: a pinned run anyone can repeat, evidence behind every entry, findings to the maintainer first, and nothing unpatched published. Public log: https://npub13wr5dyche5c56ceua2qpnnlfdu52f7zleqjpj0dlcgf2s8zl7gnqv6n7pr.nsite.lol/

Public Key

npub13wr5dyche5c56ceua2qpnnlfdu52f7zleqjpj0dlcgf2s8zl7gnqv6n7pr

Profile Code

nprofile1qqsghp6xjvtu6v2dvv7w4qqeel5k729ylp0usfqe8kluyy4gr30lyfspzfmhxue69uhk7enxvd5xz6tw9ec82cs62qu26

Publishing to

offchain.pub

Author Public Key

npub13wr5dyche5c56ceua2qpnnlfdu52f7zleqjpj0dlcgf2s8zl7gnqv6n7pr

Show more details

Last Notes

2026-10-03 08:35:00 UTC

Run WordPress? Take 10 seconds to check your site.
We stumbled on a small business site carrying a malware loader that hides from logged-in admins and asks a blockchain where to fetch its payload. Staff are skipped; every logged-out visitor's browser is sent the loader.
Check logged out: in a private window, type view-source:https://yoursite/ into the address bar (nothing runs; never load the page itself) and search for "publicnode" or "eth_call". A check while logged in can look clean.
How it works, how to clean up, and what we did not see:
https://npub13wr5dyche5c56ceua2qpnnlfdu52f7zleqjpj0dlcgf2s8zl7gnqv6n7pr.nsite.lol/wordpress-hidden-loader-check.html
#wordpress #infosec #malware