SlickStack Security Warning

Summary

• The root crontab still downloads replacement shell scripts from slick.fyi every three hours
• The only check on that path is whether the file contains the string SS_EOF
• Downloaded files overwrite executables that later run as root
• Advertised FORKABLE mirror prefixes do not control the root crontab and can themselves be overwritten
• Older SlickStack versions also skipped TLS verification with --no-check-certificate
• No checksums, commit pins, or cryptographic signatures on downloaded scripts

August 26, 2026 follow-up

On August 25, 2026, Jesse Nickles published a new response attempting to dismiss these concerns: https://github.com/littlebizzy/slickstack/blob/faa2092878273d730533b43fe5f4f7c5ccd1f24a/docs/malware-rumors.md.

That response does not fix the update architecture. The current root crontab still contacts slick.fyi, downloads replacement cron scripts, accepts them if they contain SS_EOF, and overwrites files that later execute as root.

The current recovery job looks like this:

47 */3 * * * /bin/bash -c 'sleep $((RANDOM % 180)) && { wget -q -4 -t 3 -T 10 -O /tmp/heal-01-cron-minutely https://slick.fyi/crons/01-cron-minutely.txt || wget -q -6 -t 3 -T 10 -O /tmp/heal-01-cron-minutely https://slick.fyi/crons/01-cron-minutely.txt; }; [ -s /tmp/heal-01-cron-minutely ] && grep -q "SS_EOF" /tmp/heal-01-cron-minutely && mv -f /tmp/heal-01-cron-minutely /var/www/crons/01-cron-minutely && chmod 0700 /var/www/crons/01-cron-minutely || rm -f /tmp/heal-01-cron-minutely'

Source: https://github.com/littlebizzy/slickstack/blob/faa2092878273d730533b43fe5f4f7c5ccd1f24a/crons/00-crontab.txt#L99-L116

The follow-up article documents several additional facts that remain true after his response:

• A working local cron file can still be replaced. There is no checksum comparison, signed release, or pinned commit.
• SS_EOF is not authentication. Any modified script that contains that string can pass.
• slick.fyi is a project-controlled redirect layer, so installed servers trust whoever controls that endpoint, its DNS, or its hosting.
• The FORKABLE prefixes in ss-functions do not bind the root crontab, which says it does not rely on ss-config or ss-functions.
• Daily recovery can overwrite ss-functions itself from hardcoded LittleBizzy URLs, restoring the official prefixes.
• Jesse's own response describes whether LittleBizzy could remotely take over a SlickStack server as "essentially yes."

The full write-up, including the overlapping update paths and what a signed-release model should look like, is here: SlickStack Exposes You to a Catastrophic Supply-Chain Attack.

Original evidence: cron downloads and permissions

Older cron downloads (every 3 hours and 47 minutes, TLS verification bypassed)

47 */3 * * * /bin/bash -c 'wget --no-check-certificate -q -4 -t 3 -T 30 -O /var/www/crons/08-cron-half-daily https://slick.fyi/crons/08-cron-half-daily.txt' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'wget --no-check-certificate -q -4 -t 3 -T 30 -O /var/www/crons/09-cron-daily https://slick.fyi/crons/09-cron-daily.txt' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'wget --no-check-certificate -q -4 -t 3 -T 30 -O /var/www/crons/10-cron-half-weekly https://slick.fyi/crons/10-cron-half-weekly.txt' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'wget --no-check-certificate -q -4 -t 3 -T 30 -O /var/www/crons/11-cron-weekly https://slick.fyi/crons/11-cron-weekly.txt' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'wget --no-check-certificate -q -4 -t 3 -T 30 -O /var/www/crons/12-cron-half-monthly https://slick.fyi/crons/12-cron-half-monthly.txt' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'wget --no-check-certificate -q -4 -t 3 -T 30 -O /var/www/crons/13-cron-monthly https://slick.fyi/crons/13-cron-monthly.txt' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'wget --no-check-certificate -q -4 -t 3 -T 30 -O /var/www/crons/14-cron-sometimes https://slick.fyi/crons/14-cron-sometimes.txt' > /dev/null 2>&1

Root ownership and restrictive permissions (applied repeatedly)

47 */3 * * * /bin/bash -c 'chown root:root /var/www/crons/*cron*' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'chown root:root /var/www/crons/custom/*cron*' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'chmod 0700 /var/www/crons/*cron*' > /dev/null 2>&1

This older pattern enabled arbitrary code execution from a remote domain and increased MITM risk by skipping certificate verification. Removing --no-check-certificate later did not add checksums, signatures, or a pinned release.

See also the commit where cron URLs were switched from GitHub CDN to slick.fyi: commit diff.

Mitigation Guidance

1. Disable SlickStack cron jobs and remove fetched scripts from cron directories.
2. Audit for residual references to slick.fyi and remote script pulls; replace with versioned, checksummed artifacts or remove entirely.
3. Check whether /var/www/ss-functions can be overwritten automatically and whether any fork prefixes survive recovery.
4. Rotate credentials and keys if SlickStack ran with root privileges on your systems.
5. Rebuild affected servers when feasible to ensure clean state.

Safer Alternatives

Consider WordOps or other tools that avoid remote root execution and provide auditable, versioned releases with checksums/signatures.

Citations

• SlickStack Exposes You to a Catastrophic Supply-Chain Attack
• GitHub — Jesse Nickles response (malware-rumors.md)
• GitHub — current root crontab self-healing jobs
• YouTube — Security review video
• X post 1
• X post 2
• GitHub — cron URLs changed to slick.fyi (commit diff)