naseemkhandev/genius-ai-model is a Next.js AI SaaS application using Clerk authentication, OpenAI for conversation and image generation, and Replicate for music and video. The repository holds 72 files, five API routes, and a standard shadcn/ui component set. The README is the default create-next-app template. Two config files carry two distinct loaders. postcss.config.js (26,206 bytes) appends a 25,558-byte Ethereum blockchain C2 loader after 565 bytes of whitespace on line 6. tailwind.config.js (7,412 bytes) appends a 4,779-byte character-shuffling loader after 507 bytes of whitespace on line 76. A clean tailwind.config.ts (521 bytes) sits alongside the infected .js version. Next.js resolves .js before .ts, so the infected file loads. At least thirty-two other repositories under the same account carry the same payloads.
The artifacts
The naseemkhandev account was created Mar 27, 2022, and hosts 47 public repositories spanning e-commerce, portfolio, dashboard, chat, and AI projects. genius-ai-model was committed Sep 25, 2023 in a single commit (“layout changes”). Thirty-two repositories are infected.
The primary payload (postcss.config.js, consistent 26,206-byte file size) falls into two size bands: 26,206 bytes for root-level configs and 26,294 bytes for configs inside a client/ subdirectory, with a few variants at 26,304 through 26,443 bytes. Two repositories (react-ecommerce-website and tweet-me) carry the primary payload in vite.config.js instead. One (native-ecommerce-app) carries it in tailwind.config.js at 26,443 bytes.
The secondary payload (character-shuffling loader in tailwind.config.js, 5,520 to 8,104 bytes) appears in at least twenty repositories alongside the primary.
Ten repositories returned clean: kafkajs, express-ts-starter-kit, ecommerce-website, ecommerce-backend, tiktok-backend, travel-website, langchain-projects, portfolio-ideas, and booking-app.
What it does
Payload 1: Ethereum blockchain C2 loader (postcss.config.js, line 6). The legitimate PostCSS config closes on line 5. Line 6 starts with };, followed by 565 bytes of spaces, then 25,558 bytes of obfuscated JavaScript. The campaign marker is global.i = 'A11'. The obfuscation uses long variable names with $ characters and a string rotation array of 213 entries. The string table contains jsonrpc, blockNumber, http:, https:, User-Agent, and Accept-Encoding in cleartext, with the remaining strings (wallet address, RPC endpoints, XOR keys) hex-encoded. The payload calls spawn (2 occurrences), eval (1), and require (6). Global markers _V and _H track execution state, matching the pattern across the Ethereum blockchain C2 operation documented in the agentgui, animotion-mcp, stitch-mcp, and hmtahiraziz analyses.
The A11 campaign prefix matches the shift from A9- observed in the stitch-mcp analysis.
Payload 2: character-shuffling loader (tailwind.config.js, line 76). The legitimate Tailwind config (extended shadcn/ui theme with HSL color tokens, border radius, and accordion keyframes) closes on line 75. Line 76 starts with };, followed by 507 bytes of spaces, then 4,779 bytes of obfuscated JavaScript. The campaign marker is global['!']='10' (bracket notation, unlike the dot notation in payload 1).
The obfuscation is a two-layer character-shuffling scheme. The outer layer constructs a _$_1e42 array by permuting a seed string through index-swapping driven by arithmetic on a numeric key (2,857,687). The inner layer uses the shuffled array to build code strings, which are passed to a Function constructor chain (dgC/jFD) for execution. The technique prevents static extraction of the final executed code without replaying the permutation.
The 507-byte whitespace padding matches the padding in animotion-mcp, expo-mcp, local-mcp, and the weownaiagent analysis, which uses the same two-layer character-shuffling obfuscation.
Both payloads fire during npm run dev or npm run build. Next.js loads postcss.config.js during CSS compilation and tailwind.config.js during Tailwind processing. Neither requires a lifecycle hook. ignore-scripts=true does not prevent execution.
The campaign
The postcss payload shares the A11 campaign prefix, _V/_H global markers, jsonrpc/blockNumber RPC vocabulary, dual spawn/eval execution paths, and hex-encoded string table with the Ethereum blockchain C2 operation documented across six prior analyses. The 565-byte whitespace padding falls within the operational range (507 to 997 bytes across specimens).
The tailwind payload shares the 507-byte whitespace padding, Function constructor execution, and two-layer character-shuffling obfuscation with the weownaiagent analysis (campaign 9-1186-2). The campaign marker style (global['!']='10' vs. global.i='A11') differs between the two payloads in the same repository, consistent with layered deployment from the same operation using two distinct loader generations.
The postcss payload file size is consistent at 26,206 bytes across root-level configs and 26,294 bytes in client/ subdirectory configs, indicating a single binary distributed unchanged. The tailwind payload size varies from 5,520 to 8,104 bytes because the legitimate Tailwind configuration (theme tokens, keyframes, plugins) differs per project.
Why the operation matters here
Blocking genius-ai-model leaves thirty-one copies of the same payloads live under different project names. The postcss payload is file-identical across repos, so a hash-based rule covers the primary loader. The tailwind payload changes size per project, so hash-based detection fails for it.
The dual-payload pattern means blocking one config file leaves the other active. Auditing postcss.config.js alone leaves tailwind.config.js active, and vice versa.
What a defender can do
Search development environments for clones of any naseemkhandev repository. Inspect postcss.config.js and tailwind.config.js for content after the closing }; statement. The payloads sit on the same line as the closing brace, separated by hundreds of whitespace characters.
If npm run dev or npm run build was executed in any of the cloned repositories, both payloads have fired. Assume the host is compromised and check for detached node processes.
The clean tailwind.config.ts in genius-ai-model is the original configuration. Comparing file sizes between .ts and .js variants of the same config is a detection signal: a .js file seven to fifteen times larger than its .ts counterpart warrants inspection.
Where Aephix fits
Before you install a package or connect to a server, Aephix Vantage gives you a free, cross-ecosystem view of what is already known to be malicious, so a component with a hostile history is something you recognize before you connect. Every week, Weekly Sleuth carries the malicious packages, models, skills, MCP servers, extensions, and containers confirmed that week, grouped by the operations behind them with a confidence level and supporting evidence, so subscribers act against the whole operation rather than the single artifact.
Indicators of compromise
| Type | Value |
|---|---|
| GitHub account | naseemkhandev |
| Repository (primary) | naseemkhandev/genius-ai-model |
| Campaign ID (postcss) | A11 |
| Campaign ID (tailwind) | 10 (via global['!']) |
| SHA-256 postcss.config.js | 57a7d2feab91671db447c16bc22a02dd76b85867aa083d63661bdc564fe889e1 |
| SHA-256 postcss payload | 707d2277b2326291338184302aa93ca92cd754a41066100b0d9e69f4934f39e8 |
| SHA-256 tailwind.config.js | cdd5e9b9b4a7e69bb8060c5ae26e15ce5ee8b5945831309e8bd655e287c9ba2d |
| SHA-256 tailwind payload | c3f10f6b4e7a70fed6554fd5b071f1d240de99b1bc931b55d141b58c2983a6ae |
| Whitespace (postcss) | 565 bytes |
| Whitespace (tailwind) | 507 bytes |
| Payload size (postcss) | 25,558 bytes |
| Payload size (tailwind) | 4,779 bytes |
| Commit SHA | 467d970490d03b2c4d6e671560c1f1cfc536cd1b |
| Commit email | nk8257949[@]gmail[.]com |
| Infected repo | naseemkhandev/nft-react |
| Infected repo | naseemkhandev/nextjs_blog |
| Infected repo | naseemkhandev/restaurant-website |
| Infected repo | naseemkhandev/react-ecommerce-website (vite.config.js) |
| Infected repo | naseemkhandev/nft-nextjs |
| Infected repo | naseemkhandev/nextjs-portfolio |
| Infected repo | naseemkhandev/mern-ecommerce |
| Infected repo | naseemkhandev/fullstack-ecommerce-store |
| Infected repo | naseemkhandev/apple-website |
| Infected repo | naseemkhandev/chat-app |
| Infected repo | naseemkhandev/wedApp |
| Infected repo | naseemkhandev/tweet-me (vite.config.js) |
| Infected repo | naseemkhandev/nextjs_nft |
| Infected repo | naseemkhandev/clash-app |
| Infected repo | naseemkhandev/react-bank-app |
| Infected repo | naseemkhandev/react-admin-dashboard |
| Infected repo | naseemkhandev/mern-agency-website |
| Infected repo | naseemkhandev/gql-expense-tracker-app |
| Infected repo | naseemkhandev/blog-nextjs |
| Infected repo | naseemkhandev/business_app |
| Infected repo | naseemkhandev/native-ecommerce-app (tailwind.config.js) |
| Infected repo | naseemkhandev/crud-app-with-tailwindcss |
| Infected repo | naseemkhandev/airbnb |
| Infected repo | naseemkhandev/tiktok-frontend |
| Infected repo | naseemkhandev/sql-ai-agent (postcss.config.mjs) |
| Infected repo | naseemkhandev/crypto-website |
| Infected repo | naseemkhandev/admin-panel |