BRIDGEHEAD: An npm typosquatting campaign that crosses from WSL into Windows to plant a crypto-wallet stealer

In August 2026, an attacker published 40 typosquatted npm packages mimicking popular JavaScript libraries. Each package included an install script that profiles the host environment and, upon detecting Windows or WSL, downloads a 22MB Rust-based executable from GitHub. This payload runs entirely in memory, avoiding disk writes, and targets sensitive data including cryptocurrency wallets, browser credentials, cookies, and Telegram sessions. The malware uses legitimate services for reconnaissance and exfiltration, making detection and takedown difficult. While the npm packages were removed within 84 minutes, the GitHub payload persisted for 39 hours, and the command-and-control infrastructure remained active beyond that. The campaign exploits the boundary between WSL and Windows to compromise developer machines.

The campaign enables attackers to steal high-value credentials and cryptocurrency wallets from compromised developer machines. In-memory execution and use of legitimate services reduce detection likelihood. Persistence of the GitHub-hosted payload and command-and-control infrastructure after removal of the npm packages extends the exposure window. This can result in credential theft, session hijacking, and financial loss for affected users.

The malicious npm packages were removed within 84 minutes, but the GitHub-hosted payload and command-and-control servers remained active for longer periods. Users should avoid installing packages from untrusted or suspicious sources, particularly typosquatted packages mimicking popular libraries. Monitoring for unusual network activity related to GitHub-hosted executables and blocking known command-and-control domains can help reduce risk. Verifying package integrity and using package signing or lockfiles is recommended to mitigate supply-chain risks. Patch status is not applicable as this is a campaign leveraging social engineering and supply-chain abuse rather than a software vulnerability.