.png)
StepSecurity Is Now Available on Azure Marketplace
The StepSecurity App is now available on Azure Marketplace—simplifying procurement, deployment, and CI/CD security in one place.
Instead, they paved over it.
The Ghosts of Keramat 2: When a Housing Estate Refused to Forget
Most people know the story of Keramat Datuk Keramat — the shrine to a pious figure or local guardian spirit, marked by yellow cloth, incense, and offerings of roses and sticky rice. But few speak of Keramat 2 : the site of a 1970s condo development that went inexplicably wrong.
Keramat 2 isn’t a ghost story about fear. It’s a story about forgetting — and how some ground refuses to be erased. keramat 2
In the shadow of a newly built LRT extension, just off the bustling Jalan Keramat, sits a row of terrace houses that real estate agents politely describe as “vintage.” Residents call it something else: Keramat 2 — not an official address, but a whispered name. It refers to a patch of land where a second, forgotten keramat lies buried beneath concrete, car parks, and karaoke lounges.
By N. A. Rahman
By 1978, all original residents had moved out. The condos became low-budget offices, then a budget hotel. Now, it’s a half-empty commercial lot with a dodgy massage parlor and a 24-hour convenience store whose staff refuse to work the night shift alone. Instead, they paved over it
In 2019, a university student named Mira decided to document Keramat 2 for an anthropology project. She placed a voice recorder on the spot where the grave was believed to be — now the back alley behind a fried chicken shop. At 2:22 AM, the recorder captured what sounds like a woman’s voice humming an old Malay lullaby, “Anak ayam turunlah sepuluh…” Then a sharp whisper: “Jangan bina di sini.” (Don’t build here.)
According to oral history collected by a retiree named Pak Hassan, the original keramat was a grave of a 19th-century wanita keramat (saintly woman) named Tok Salmah, believed to have healed snake bites and calmed storms in the Klang Valley. When developers razed the hill in 1974 to build “Taman Mewah Fasa 2,” workers discovered an unmarked grave. The bomoh (shaman) hired to relocate the spirit advised building a small shrine at the edge of the site. They didn’t.
The first sign of trouble was a crane that toppled sideways for no reason. Then, during the grand opening of the condo’s swimming pool, the water turned murky green overnight. Residents reported a woman in a kebaya sitting by the pool at 3 a.m., combing her long hair in silence. The building’s lifts would stop at the fourth floor — floor four, tingkat empat — even when no one pressed the button. Maintenance crews found the button permanently stained with kunyit (turmeric), as if from an invisible hand. Keramat 2 isn’t a ghost story about fear
When Mira played the recording for Pak Hassan, he wept. “Tok Salmah is not angry,” he said. “She is tired. She just wants to be remembered.”
As of last month, the fried chicken shop reported that their fryer oil lasts twice as long as usual, and no rats have been seen behind the building for over a year. Tok Salmah, it seems, is keeping the peace — one chicken wing at a time.
Today, a small keramat has been unofficially rebuilt — tucked between a dumpster and a motorcycle parking bay. You’ll see wilted jasmine garlands, a small cup of coffee, and a single yellow candle flickering against the wind. The condo’s management pretends not to notice. The cleaners know not to touch it.
.png)
The StepSecurity App is now available on Azure Marketplace—simplifying procurement, deployment, and CI/CD security in one place.
Jake Karger
December 11, 2025

Security researchers have uncovered severe unauthenticated remote code execution vulnerabilities in React Server Components and Next.js App Router that achieve near 100% exploitation success rates. With 39% of cloud environments running vulnerable versions and 44% having publicly exposed Next.js instances, immediate patching is critical. Organizations should upgrade to patched versions and use StepSecurity's npm package search and Threat Center to identify and monitor affected dependencies.
Ashish Kurmi
December 3, 2025
.png)
A case study on detecting npm supply chain attacks through runtime monitoring and baseline anomaly detection
Varun Sharma
December 3, 2025