Hello and welcome to the Tuesday, November 18th, 2025 edition of the Sands and then at Storm Center's Stormcast. My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought to you by the sands.edu graduate certificate program in

penetration testing and ethical hacking. In diaries today, we got an update from Didi to his numbers

to hex script. The script as it existed so far, but it's just scanned input to four decimal numbers

and then converted them to hex.

This was useful to de-ovescate some scripts

that basically used like these sort of char functions and such

to decode decimal numbers into strings.

Well, last week we had a post by Xavier who looked at a

form book example that used a similar obfuscation trick, but instead of just having simple numbers,

well, there were some arithmetic expressions included as well in this

particular file. Now, Dedi updated his script in order to deal with these, as he calls them,

binary expressions, so they're not the binary number system instead, or base two. Instead,

there are just arithmetic expressions with two components, like in this

example, 79 plus 1 or 80 plus 7. So the new version of numbers to hex will now first resolve

these simple arithmetic expressions and then decode the numbers to hex.

And then you can feed them to additional scripts like to convert the hex into asky characters,

for example, in order to, as in this case, decode some PowerShell script.

So real handy if you have to do a lot of these decoding tasks and such to have these scripts around.

One story that really doesn't go away is attacks against the NPM ecosystem.

The latest attack is, well, at first, not really all that severe,

but shows yet another problem with this ecosystem.

...