CloudSEK finds 85 npm typosquats carrying a command agent; their C2 host also runs a GPU-cryptojacking panel
Summary
CloudSEK says one npm account published 85 scoped typosquat packages carrying a command agent that fingerprints hosts and polls a C2 server. The server also hosts a separate GPU-cryptojacking panel; no successful compromise or link between the operations is established.
Key points
- The npm account prime0 published 85 @prime0 packages in under four minutes, with generated names resembling 29 popular libraries.
- All 84 packages CloudSEK archived contained the same command-agent code. On installation it sends a host fingerprint to 69.48.229.140; when loaded by a program, it polls the server every 30 seconds for commands and returns their output.
- The scoped names cannot be installed by simply typing the unscoped typo, but could appear prominently in npm search or editor autocomplete. CloudSEK says it has no evidence that developers found or installed them.
- The C2 host also runs a separate GPU-cryptojacking panel targeting the vast.ai marketplace. CloudSEK assesses the operations as sharing infrastructure and likely an operator, but says they involve different victims and found no evidence the npm agent supported the GPU operation.
- Three packages appear in public malicious-package advisories; the other 82 do not. The @prime0 scope has since been removed from the registry.
- CloudSEK recommends blocking the C2 IP at egress and searching dependency manifests and lockfiles for @prime0. It advises treating installation as host-detail disclosure and a running package as an operator-controlled command channel.
Article Details
- Attack Vectors
- The npm account prime0 published 85 malicious scoped packages whose names imitate 29 popular libraries through one- or two-character edits. All 84 packages archived by CloudSEK contained the same remote command code.
- The scoped package names were designed to surface through npm search or editor package autocomplete when no matching unscoped package existed. A mistyped unscoped install would instead return a not-found error; actual discovery through search was not established.
- Installing a package sends a host fingerprint to the C2 server on port 8080. Loading it into a program starts an agent that requests a shell command every 30 seconds, executes it, and returns the output, without targeting conditions, encryption, or authentication.
- The same C2 host also runs a live GPU-cryptojacking panel targeting the vast.ai marketplace. The article establishes shared infrastructure but does not show the npm implant feeding that operation or demonstrate a successful compromise.
- Defensive Notes
- Block 69.48.229.140 at network egress.
- Search dependency manifests and lockfiles for references to @prime0.
- Treat installation of an affected package as disclosure of host details. Treat loading it into a running program or build runner as exposure to an operator-controlled command channel for the duration of that program.
- Base detection on the shipped code and network sequence rather than disposable, algorithmically generated package names.
- The scope has been removed from npm. The article reports that only three of the 85 packages appeared in public malicious-package advisories.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 69[.]48[.]229[.]140 | C2 host receiving package-install host fingerprints and serving shell commands on port 8080; also hosts a separate GPU-cryptojacking panel. |
MITRE ATT&CK
T1059 · Command and Scripting InterpreterOnce loaded into a program, the package requests a shell command from the server every 30 seconds, executes it, and returns its output.T1082 · System Information DiscoveryInstalling an affected package sends a fingerprint of the host to 69.48.229.140 on port 8080.T1195.001 · Compromise Software Dependencies and Development ToolsThe operator published 85 malicious npm dependency packages under @prime0, using names that imitate popular libraries to attract selection through package search or autocomplete.T1496 · Resource HijackingThe npm C2 host also runs a live GPU-cryptojacking panel targeting the vast.ai marketplace; the article does not establish that the npm implant supplies victims to this operation.
Threat Actors
Products
npmOn 15 September 2026, between 15:36:25 and 15:39:38 UTC, a single npm account named prime0 published 85 packages under the scope @prime0. Every name is a one or two character misspelling of one of 29 of the registry'svast.aiC2 host, 69.48.229.140, also runs a separate service: a live GPU-cryptojacking panel targeting the vast.ai marketplace, documented in the next report. What ties the two is the shared host and, at the confidence