security

• The Node That Killed Its Own Host — cgroups, Sled, and a 2.3 GB Miner on 8 GB of RAM

  Part two of the DarkFi Pi: the node grew to 4.5 GB and was taking the host down with it. Notes on why the memory limits I wrote were ignored, why swap made it worse, how the OOM fight corrupted the database, and what a RandomX miner really costs.

  7/14/2026 · 19 min

• Reverse-Engineering a North-Korean-Style Supply Chain Attack Delivered via Fake Web3 Job Interview

  Full forensic analysis of a targeted supply chain attack delivered through a fake Web3 job interview. A single npm install silently deployed a two-stage RAT: an initial loader that decrypts a second-stage C2 endpoint, exfiltrates the full process environment, and maintains a persistent TCP beacon on port 1224 awaiting operator commands. I got targeted, responded in 45 minutes, then reproduced the entire attack chain in an isolated Hetzner VM and captured the complete C2 protocol.

  4/15/2026 · 30 min