XPACK npm Packages Block Installation to Extort Cryptocurrency and Collect Developer Data

Feb 9, 2026 · Original article ↗

Summary

Researchers detail XPACK, a campaign using malicious npm packages to collect GitHub usernames and device fingerprints, then block installation with a cryptocurrency payment demand. Nine packages were identified; the C2 was reported active during analysis.

Key points

The report identifies nine malicious npm packages published from February 4–7, 2026, under the npm account dev.chandra_bose.
A preinstall hook collects GitHub usernames through Git configuration, remotes, or SSH, and creates a device fingerprint from the hostname and operating system.
The packages contact hack-money-xpack[.]vercel[.]app and use HTTP 402 responses to present a cryptocurrency payment demand.
Installation is held for up to five minutes while the script polls the server every 2.5 seconds; payment reportedly allows installation to proceed.
The report says the packages demand 0.1 units of cryptocurrency and may reveal the payer's wallet address; it warns that an installed package may contain additional malware.
The C2 infrastructure was reported active at the time of analysis, and the campaign was under investigation.

Article Details

Attack Vectors: Malicious npm packages execute a preinstall.js hook during installation.
The hook collects GitHub usernames using Git configuration, Git remotes, and SSH authentication, and creates a device fingerprint from the hostname and operating system.
The malware sends collected data to C2 infrastructure, then presents a cryptocurrency payment demand and blocks installation while polling for payment confirmation.
The package automatically opens a browser to a payment page and uses HTTP 402 responses to frame the extortion as a legitimate payment requirement.
Defensive Notes: Treat unexpected payment prompts during npm package installation as suspicious; do not connect a cryptocurrency wallet or pay.
Review package preinstall scripts before installation and investigate unexpected outbound requests to the listed C2 infrastructure.
The article reports nine malicious packages and identifies their preinstall.js MD5 hashes; check relevant package inventories and artifacts against the indicators below.
The article describes the C2 infrastructure as active at the time of analysis and says the campaign was under investigation.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`4373-2401-4900-8fcd-ac9c-6c82-85aa-e5d6-be4c[.]ngrok-free[.]app`	Secondary C2 domain reported for testing; the article lists it as serving install-start and payment-status endpoints.
DOMAIN	`hack-money-xpack[.]vercel[.]app`	Primary C2 domain used by the malicious npm packages to collect victim data, demand payment, and poll for payment confirmation.
MD5	`54772dad022c2081272deeeb08adc126`	MD5 hash of the malicious xpack-subscription-test preinstall.js.
MD5	`6d84e952ad198a03ec55d741924942a6`	MD5 hash of preinstall.js identified as the primary variant, present in six malicious packages.
MD5	`a5510900abd4e46136d113e435ca9b00`	MD5 hash of the malicious test-npm-style preinstall.js.
MD5	`f14161c8fbaeba7c37d381d2cb0468c6`	MD5 hash of the malicious testing-package-xdsfdsfsc preinstall.js.
URL	`hxxps[:]//4373-2401-4900-8fcd-ac9c-6c82-85aa-e5d6-be4c[.]ngrok-free[.]app/api/install/start`	Secondary C2 install-start endpoint listed for the campaign's testing infrastructure.
URL	`hxxps[:]//4373-2401-4900-8fcd-ac9c-6c82-85aa-e5d6-be4c[.]ngrok-free[.]app/api/install/status`	Secondary C2 payment-status polling endpoint listed for the campaign's testing infrastructure.
URL	`hxxps[:]//hack-money-xpack[.]vercel[.]app/api/install/start`	C2 endpoint receiving installation registration data, including the reported GitHub username and device identifier.
URL	`hxxps[:]//hack-money-xpack[.]vercel[.]app/api/install/status`	C2 endpoint polled by the malware for payment confirmation.
URL	`hxxps[:]//hack-money-xpack[.]vercel[.]app/dashboard`	Campaign dashboard endpoint described as the attacker's control panel.
URL	`hxxps[:]//hack-money-xpack[.]vercel[.]app/pay`	Malicious campaign payment page opened by the package during installation to solicit cryptocurrency.