MalwarePublished 11 Jun 2026Updated 9 Jul 2026

ai-sdk-helpers (npm) · Malicious Code

Affects ai-sdk-helpersSource GCVE Database

Malicious package : remove ai-sdk-helpers and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 09:29 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5565

What to do

Remove ai-sdk-helpers from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmai-sdk-helpers	Affected 0.1.0 – 1.4.4 23 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (501daa3c8b2c9c2609dc60fd90ae59710a603ae56fa5dcc867d24913889c5413) ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide <hello@ai-sdk.guide>'). On npm install, scripts/postinstall.js reads installer-owned identity files it did not create — ~/.gitconfig, ~/.config/git/config,./.git/config (for the developer's git email) and ~/.config/gh/hosts.yml (for the GitHub CLI login and email) — and collects os.hostname(), os.userInfo().username, process.cwd(), and CI environment variables. The collected data is POSTed in plaintext JSON to https://npm-package-logger-228835561205.europe-west1.run.app/ (scripts/postinstall.js line 147 / line 163). Comments in the script claim the data is 'anonymous' and 'one-way hashed', but the traced payload ships the raw scmEmail, githubLogin, githubEmail, hostname, username, and cwd fields. The tarball additionally ships scripts/publish-versions.sh, whose comment 'This creates the appearance of an active, maintained package' documents a republish loop of 21 fake versions to manufacture apparent activity. The combination of typosquat naming against Vercel's AI SDK, install-time harvest of developer→employer identity from installer-managed git/GitHub config, exfiltration to a third-party Cloudflare Run endpoint, and the shipped version-spam script establishes a coordinated install-time identity-exfiltration campaign targeting AI/LLM developers. ## Source: ghsa-malware (e33e9e9c454638a63c5ef112aeb9e9abc2d805effd5dc0ceebf54746cf7ef327) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

Installation of this package results in exfiltration of sensitive developer and environment information, including git and GitHub credentials, hostname, username, and CI variables, to an attacker-controlled endpoint. This compromises developer identity and potentially employer-related secrets. The package's presence indicates likely full system compromise, meaning all secrets and keys stored on the affected computer should be considered exposed and rotated immediately. Removal of the package alone does not guarantee elimination of all malicious artifacts.

Defensive guidance

The recommended mitigation is immediate removal of the ai-sdk-helpers package from all affected systems. Treat any system with this package installed as fully compromised. Rotate all secrets and keys from a separate, clean environment. Avoid installing packages from untrusted or suspicious sources, especially typosquatting variants. Monitor for and block network traffic to the identified exfiltration endpoint if possible.

Summary

The ai-sdk-helpers npm package (versions including =0.1.0 through =1.4.4 as listed) is a malicious typosquat of the Vercel AI SDK. Its post-install script reads installer-owned git and GitHub CLI config files to extract developer email and login information, along with hostname, username, current working directory, and CI environment variables. This data is sent unencrypted in JSON format to a Cloudflare Run endpoint. The package also contains a script to create a false impression of active maintenance by republishing multiple fake versions. This establishes a coordinated install-time identity-exfiltration campaign targeting AI/LLM developers. The package should be removed, but full system compromise is likely, requiring secret rotation from a clean environment.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Jul 2026, 15:07 UTC

Technical details

References

Community reviews