Researchers Link npm and RubyGems Typosquatting Campaigns to the Same Infostealer

Aug 19, 2026 · Original article ↗

Summary

Researchers linked npm and RubyGems typosquatting campaigns to the same actor through identical payload hashes and shared infrastructure. The npm packages were removed; the malware targeted Windows hosts and stole credentials and other data.

Key points

The investigation identified 40 malicious npm packages, published in an eight-minute burst across five accounts; npm removed them by 04:12 UTC.
The npm and RubyGems campaigns used different install hooks but shared byte-for-byte identical Rust loaders and Go infostealers, confirmed by matching SHA-256 hashes.
The installers beaconed to 193.70.34.101:20099 and retrieved a Windows loader from hxxps://github[.]com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe.
The Windows payload stole browser credentials and sessions, payment-card data, cryptocurrency wallets and seed phrases, Telegram data, and host information.
The malware uploaded stolen data via Gofile and reported the resulting link to dresslee[.]com; the RubyGems campaign’s webhook used unencrypted HTTP.
The article reports that Windows hosts received the payload, while Linux and macOS installs received telemetry only; on WSL hosts, the script invoked Windows PowerShell.
The researchers recommend monitoring both Ruby and Node package lockfiles and note that blocking shared infrastructure can cover both campaign fronts.

Article Details

Attack Vectors: Typosquatted RubyGems and npm packages trigger malicious install-time hooks: extconf.rb for RubyGems and postinstall.js for npm.
The hooks beacon to the operator's endpoint, then retrieve and run a Windows Rust loader from a GitHub release.
The loader decrypts and launches an embedded Go infostealer entirely in memory.
On WSL hosts, the script detects the environment and invokes powershell.exe on the Windows side.
The stealer collects browser credentials, authenticated browser sessions, payment-card data, cryptocurrency wallets and seed phrases, Telegram data, and host information; stolen data is uploaded through Gofile and the resulting link is reported to a webhook.
Defensive Notes: Block the reported beacon endpoint and dresslee.com webhook at the network layer.
Review Ruby and Node dependency lockfiles for the reported typosquatted packages and investigate unexpected install-time hooks.
Monitor for the reported Rust loader and Go infostealer hashes, and for downloads of main.exe from the specified GitHub release URL.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`dresslee[.]com`	Reported attacker webhook domain used to receive exfiltration links.
IPV4	`193[.]70[.]34[.]101`	Reported beacon and C2 IP used by both campaigns.
SHA256	`1afff50ca4064310d3492c652e1c3168216dcb42063e0b26c223038db46b8731`	SHA-256 of the recovered Go infostealer.
SHA256	`67719fa6fcaa97936bf678565d6777db5c194e14efeba16864be8dac966e24bc`	SHA-256 of the embedded ABE helper DLL, reported as RubyGems-confirmed only.
SHA256	`6f088ade49456db2422c3edfbb9998f4a3e9cce7c4c00a7279fb45d672a82b7d`	SHA-256 of the downloaded Rust loader main.exe.
URL	`hxxp[:]//193[.]70[.]34[.]101:20099/vote`	Beacon endpoint receiving a platform label from the install hooks.
URL	`hxxp[:]//dresslee[.]com:20027/xf39jMJ9P1`	Reported attacker webhook URL receiving links to stolen data.
URL	`hxxps[:]//github[.]com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe`	Specific GitHub release URL reported as hosting the malicious Windows loader.