Npm Typosquatting Campaign Uses WSL to Deliver a Windows Crypto and Credential Stealer

Article Details

Attack Vectors

• Forty malicious npm packages imitated chalk, axios, commander, lodash, react and typescript through typosquatting or namespace-squatting. Each package used an install hook to execute scripts/postinstall.js.
• The install script reported an operating-system label to an operator-controlled collector and deployed the Windows payload only on native Windows or Windows Subsystem for Linux hosts.
• Inside WSL, XOR-decoded instructions launched hidden PowerShell on the Windows host, downloaded main.exe from a GitHub release and executed it from %TEMP%.
• On native Windows, the install script downloaded main.exe using Node's HTTPS client and launched it directly, without PowerShell or a shell.
• The Rust wrapper decoded and decrypted an embedded stage in memory and executed it within its own process. No separate stage executable or child process was observed.
• Recovered memory contained target lists for desktop cryptocurrency wallets, browser credential and cookie stores, and Telegram session directories. The payload attempted an upload to a public file-sharing service, but laboratory certificate rejection prevented successful exfiltration.

Defensive Notes

• Block the operator-controlled collector at 193.70.34.101:20099, which the report found still answering on 2026-08-18.
• Purge the forty malicious package names listed in Appendix A from lockfiles, private mirrors and CI caches; registry removal does not eliminate cached copies.
• Investigate affected Windows and WSL hosts for %TEMP%\main.exe and package-install processes that launch hidden PowerShell or directly write and start executables in %TEMP%.
• Cover both delivery branches in detection rules: PowerShell-based detection alone misses native-Windows execution.
• Monitor WSL install hooks that inspect WSL environment variables or /proc metadata and subsequently invoke Windows binaries.
• Use the mutated cipher constant expad 232-byte k and oversized hexadecimal-text .rdata sections as wrapper detection anchors. The report measured no false positives for its PE-side anchors among 12,599 tested executables.
• Correlate same-process connections to api.ipify.org followed shortly by upload.gofile.io. These are legitimate services and should not be treated as malicious infrastructure in isolation.
• Do not interpret an absent dropped stage, child process or persistence mechanism as evidence of safety; the observed stage ran in-process and was short-lived.
• For hosts that executed the payload, the report recommends treating wallet and browser credential material as compromised, rotating browser-stored credentials and sessions, and moving funds from affected desktop wallets.
• Disable WSL interoperability where Linux tooling does not need to launch Windows binaries.
• Pursue off-registry payload infrastructure separately from malicious package takedowns.