The Wayback Machine - https://web.archive.org/web/20250420055050/https://github.com/nopcorn

nopcorn

Follow

🤘

nopcorn nopcorn

🤘

Follow

I’m an Offensive Security Engineer that likes to research interesting security topics and break stuff.

24 followers · 13 following

Achievements

Achievements

nopcorn/README.md

   .-~~-.    
  (_^..^_)    0x64325673593239745a534230627942746553426e6158526f64574967584867354d413d3d
    ||||    /  
    `--'

Github Security Research

CVE-2025-32953: Exposure of the GITHUB_TOKEN in workflow run artifact in udo-munk/z80pack
GHSA-h4c9-2c5c-fwfc: Github Token Compromise in Pex Repository in pex-tool/pex
GHSA-8ffm-p88r-g625: pending
GHSA-535w-4488-jc7p: pending
GHSA-35g9-52wf-83hw: pending
GHSA-q656-gjrm-9mh5: pending
GHSA-f78v-x25j-8x42: pending

Pinned Loading

DuckDuckC2 DuckDuckC2 Public

A proof-of-concept C2 channel through DuckDuckGo's image proxy service

Python 74 5
CuteRAT CuteRAT Public

CuteRAT is a stealthy remote access tool without any dependencies

Python 16
RascalRunner RascalRunner Public

A red team tool to leverage Github workflows and self-hosted runners

Python 6
githubaudit githubaudit Public

Uses a Github PAT to assess the security configuration of repositories and provides a report

Python 1