https://threatprophet.com/tags/github-repository/Recent content in Github-Repository on ThreatProphetHugo -- 0.163.0en-usTue, 09 Jun 2026 00:00:00 +0000https://threatprophet.com/posts/2026-06-09-ajunaverse-alchemymvp/Tue, 09 Jun 2026 00:00:00 +0000https://threatprophet.com/posts/2026-06-09-ajunaverse-alchemymvp/Forensic comparison of two parallel GitHub repositories derived from the Gamifly/BetPoker poker-game lineage. AjunaVerse and AlchemyMVP contain nearly identical current trees, synchronized malicious commits, redundant VS Code and npm execution paths, a cross-platform Vercel staging chain, and an env.npl registrar implant linked to the recurring TCP/1224 /api/checkStatus toolkit.https://threatprophet.com/posts/2026-06-09-gamifly-interexy/Tue, 09 Jun 2026 00:00:00 +0000https://threatprophet.com/posts/2026-06-09-gamifly-interexy/Analysis of two byte-identical Gamifly GitHub repositories delivered through a LinkedIn and Calendly recruitment workflow. The repositories reuse the BetPoker/Dravion loader architecture, automatically launch a backend through VS Code and npm lifecycle mechanisms, exfiltrate the complete Node.js environment to a Vercel gate, and execute an obfuscated five-second tasking implant. Follow-on hunting identified AjunaVerse and AlchemyMVP as later sibling branches of the same weaponized Git lineage.