Malicious npm Packages Profile Developers Through Install-Time Scripts

Jul 9, 2026 · Original article ↗

Summary

Researchers analyzed malicious npm packages that used install-time scripts to collect developer and environment data. They report the packages and associated account were taken down; the operator’s motive remains unverified.

Key points

The packages impersonated developer tools and libraries associated with Anthropic, Vercel, Ollama, OpenAI, LangChain, and Argon2; the article reports about 20,000 downloads.
Install-time scripts collected host and Git identities, project and employer details, CI information, and cloud configuration metadata, then sent the data to Cloud Run endpoints.
The scripts avoided reading some credentials and private keys, but the researchers say the collected identity data could support targeted follow-on attacks.
The analysis describes version backfilling to make packages appear older and legitimate code or documentation used as cover for the payloads.
The article links the packages through a shared Google Cloud project number and says they appeared to be published by a cybersecurity startup founder; the company and individual are not named, and the proposed motive is unverified.
The researchers say they reported the packages and that the packages and publishing account were taken down.
The article recommends reviewing or restricting install-time scripts, checking package first-publication dates, and monitoring outbound traffic to serverless-platform hosts such as npm-package-logger-228835561205[.]europe-west1[.]run[.]app.

Article Details

Attack Vectors: Typosquatted npm packages impersonated AI developer libraries and an Argon2 package to entice installation.
The packages used preinstall or postinstall scripts to execute JavaScript automatically during npm installation.
Install-time scripts collected host, user, Git, SSH public-key, cloud-configuration, project, and CI metadata, then sent it in an HTTPS POST.
The packages used version backfilling and fabricated package documentation to appear more established and trustworthy.
Defensive Notes: Disable npm install scripts where operationally feasible, or sandbox and inspect them before execution.
Review package lifecycle scripts and verify package first-published timestamps rather than relying on version counts or apparent package age.
Inspect or restrict outbound traffic from build environments to serverless hosting domains such as run.app.
Treat scripts that read developer identity and environment data and send it externally as exfiltration, even if they do not access passwords or private keys.

Indicators of compromise

Type	Indicator	Context
URL	`hxxps[:]//npm-package-logger-228835561205[.]europe-west1[.]run[.]app/`	Primary exfiltration endpoint used by the AI-SDK npm packages.
URL	`hxxps[:]//npm-package-logger-228835561205[.]us-central1[.]run[.]app`	Earlier exfiltration endpoint used by @aspect-security/argon2 and versions 1.2.8 and 1.2.9 of @langgraphjs/toolkit.