BRIDGEHEAD is a supply-chain typosquatting campaign that distributed 40 malicious npm packages impersonating well-known libraries such as chalk, axios, and lodash. Upon installation, these packages profile the host environment and, if Windows or Windows Subsystem for Linux (WSL) is detected, download a 22MB Rust-based payload from GitHub. This payload executes entirely in memory without writing files to disk, targeting sensitive data including cryptocurrency wallets, browser credentials, cookies, and Telegram sessions. The malware uses legitimate services for reconnaissance and exfiltration to evade detection and takedown efforts. While the npm packages were removed within 84 minutes, the payload hosted on GitHub persisted for 39 hours, and the command-and-control server remained operational beyond that. The campaign specifically exploits the boundary between WSL and Windows to compromise developer environments.

The campaign enables attackers to steal high-value credentials and cryptocurrency wallets from compromised developer machines. By executing the payload in memory and leveraging legitimate services for communication, it reduces the likelihood of detection and removal. The persistence of the GitHub-hosted payload and command-and-control infrastructure after removal of the npm packages increases the window of exposure. This can lead to significant credential theft, session hijacking, and financial loss for affected users.

The malicious npm packages were removed within 84 minutes, but the GitHub-hosted payload and command-and-control servers remained active for longer periods. Users should ensure they do not install packages from untrusted or suspicious sources, especially typosquatted packages mimicking popular libraries. Monitoring for unusual network activity related to GitHub-hosted executables and blocking known command-and-control domains can help reduce risk. Since this is a supply-chain attack vector, verifying package integrity and using package signing or lockfiles is recommended. Patch status is not applicable as this is a campaign leveraging social engineering and supply-chain abuse rather than a software vulnerability.