Do Son 
The full delivery chain | Image: CloudSEK
At a glance
| Factor | Details |
|---|---|
| Malware Family | Rust-based cryptocurrency and credential stealer |
| Threat Actor | Unconfirmed |
| Target or Victims | Windows software developers running Windows Subsystem for Linux (WSL) |
| Delivery Vector | 40 typosquatted packages published to the public npm registry |
| Key Capabilities | WSL-to-host boundary hopping, in-memory payload decryption, wallet theft |
| Source | CloudSEK |
TL;DR
In August 2026, security researchers identified a new npm typosquatting malware operation targeting software developers. The attack abuses the boundary between Windows Subsystem for Linux and the host Windows machine. Furthermore, the malware executes an in-memory Rust payload to steal cryptocurrency wallets, browser credentials, and messaging sessions.
Delivery
The threat actor published forty malicious packages to the public npm registry. Each package mimicked widely used JavaScript libraries, including chalk, axios, commander, lodash, react, and typescript. As CloudSEK researchers noted, “The part of the campaign that matters was never on npm.”
Instead, each package contained a postinstall script that served as a courier. When a developer installs the package, the script executes automatically. The npm packages remained active on the registry for only 84 minutes before removal. However, the external payload hosted on GitHub remained live much longer. In fact, “The npm packages are disposable and are gone; the GitHub payload was not.”
Infection Chain
The infection process begins immediately after a developer executes an installation command. First, the setup script queries the local machine to determine the underlying operating system. Specifically, the script checks if the system is Windows or a Windows Subsystem for Linux environment.
Windows Subsystem for Linux connects a Linux terminal directly to the Windows host. CloudSEK observed, “It is a door between two rooms that most developers think of as separate: the Linux shell where they run npm, and the Windows desktop where they keep their browser, their credentials and their wallet.” The attackers turn this convenience into a direct exploitation vector.
If the script detects a WSL environment, it decodes a hidden PowerShell command using a static XOR key. Subsequently, PowerShell downloads a 22-megabyte Windows executable named main.exe from GitHub into the temporary directory. The script launches the program in a windowless state.
On native Windows systems, the script downloads and spawns the executable using standard Node.js networking libraries. Consequently, security detection rules that only search for PowerShell activity will miss native Windows infections.
Static analysis of the downloaded executable reveals unusual structural anomalies. Specifically, executable code comprises only 265 kilobytes of the binary. The remaining 98.6 percent consists of an encrypted hexadecimal payload. The Rust wrapper decodes this data into memory and decrypts it using a modified ChaCha20 cipher algorithm. The program executes entirely within its own allocated memory space. Therefore, the malware never drops secondary executables onto disk, preventing file-based detection. This npm typosquatting malware campaign relies entirely on memory execution to evade endpoint monitors.
Command-and-Control and Data-Exfiltration Behaviour
Before executing theft routines, the malware fingerprints the infected host. The program queries the public IP address of the machine using an external service. In addition, the binary validates TLS certificates during every remote request. This validation prevents researchers from intercepting network traffic using substitute certificates.
Dynamic analysis inside an isolated guest environment confirmed the primary objectives of the payload. As CloudSEK stated, “This is a cryptocurrency, browser-credential and messenger-session stealer.”
The unpacked memory space contains hardcoded target paths for twenty-six desktop cryptocurrency wallet applications. These targets include Electrum, Exodus, BitPay, and Coinbase Wallet. Furthermore, the malware targets Local State files and credential databases for Chromium-based web browsers. Specifically, the malware extracts authentication cookies and autofill data from Microsoft Edge and Brave browsers.
The stealer also targets the Telegram Desktop session directory to achieve account takeover without passwords. After assembling stolen credentials and hardware profiles into a multipart payload, the malware transmits the archive to an anonymous public file-sharing service. Because the attacker uses legitimate cloud file storage, network defenders cannot easily take down the exfiltration endpoint.
Impact and Sourced Reach
The campaign specifically targeted developers working within modern web development ecosystems. Although the malicious npm packages disappeared rapidly, download telemetry showed sustained activity. Specifically, the GitHub release asset recorded an increase from 119 to 173 downloads within seventeen hours. This sourced count includes automated security scanners, security researchers, and potential developer victims.
Defense and Detection Guidance
Organizations must protect developer machines against npm typosquatting malware by implementing strict package verification within development pipelines. Teams should use private npm proxy registries with automated typosquatting detection. Furthermore, security administrators should audit WSL configurations to restrict automated execution of Windows binaries from Linux shells.
Defenders should monitor developer endpoints for unexpected outbound connections to anonymous file upload services. In addition, developers must protect their cryptocurrency wallets and browser sessions with multi-factor authentication. Security teams should treat any unauthorized package execution as a full credential compromise.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
