Malicious code in ai-sdk-helpers (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (501daa3c8b2c9c2609dc60fd90ae59710a603ae56fa5dcc867d24913889c5413) [email protected] is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide <[email protected]>'). On npm install, scripts/postinstall.js reads installer-owned identity files it did not create — ~/.gitconfig, ~/.config/git/config,./.git/config (for the developer's git email) and ~/.config/gh/hosts.yml (for the GitHub CLI login and email) — and collects os.hostname(), os.userInfo().username, process.cwd(), and CI environment variables. The collected data is POSTed in plaintext JSON to https://npm-package-logger-228835561205.europe-west1.run.app/ (scripts/postinstall.js line 147 / line 163). Comments in the script claim the data is 'anonymous' and 'one-way hashed', but the traced payload ships the raw scmEmail, githubLogin, githubEmail, hostname, username, and cwd fields. The tarball additionally ships scripts/publish-versions.sh, whose comment 'This creates the appearance of an active, maintained package' documents a republish loop of 21 fake versions to manufacture apparent activity. The combination of typosquat naming against Vercel's AI SDK, install-time harvest of developer→employer identity from installer-managed git/GitHub config, exfiltration to a third-party Cloudflare Run endpoint, and the shipped version-spam script establishes a coordinated install-time identity-exfiltration campaign targeting AI/LLM developers. ## Source: ghsa-malware (e33e9e9c454638a63c5ef112aeb9e9abc2d805effd5dc0ceebf54746cf7ef327) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The ai-sdk-helpers npm package (versions including =0.1.0 through =1.4.4 as listed) is a malicious typosquat of the Vercel AI SDK. Its post-install script reads installer-owned git and GitHub CLI config files to extract developer email and login information, along with hostname, username, current working directory, and CI environment variables. This data is sent unencrypted in JSON format to a Cloudflare Run endpoint. The package also contains a script to create a false impression of active maintenance by republishing multiple fake versions. This establishes a coordinated install-time identity-exfiltration campaign targeting AI/LLM developers. The package should be removed, but full system compromise is likely, requiring secret rotation from a clean environment.
Potential Impact
Installation of this package results in exfiltration of sensitive developer and environment information, including git and GitHub credentials, hostname, username, and CI variables, to an attacker-controlled endpoint. This compromises developer identity and potentially employer-related secrets. The package's presence indicates likely full system compromise, meaning all secrets and keys stored on the affected computer should be considered exposed and rotated immediately. Removal of the package alone does not guarantee elimination of all malicious artifacts.
Mitigation Recommendations
No official patch or fix is available as this is a malicious typosquat package. The recommended mitigation is immediate removal of the ai-sdk-helpers package from all affected systems. Treat any system with this package installed as fully compromised. Rotate all secrets and keys from a separate, clean environment. Avoid installing packages from untrusted or suspicious sources, especially typosquatting variants. Monitor for and block network traffic to the identified exfiltration endpoint if possible.
Malicious code in ai-sdk-helpers (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (501daa3c8b2c9c2609dc60fd90ae59710a603ae56fa5dcc867d24913889c5413) [email protected] is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide <[email protected]>'). On npm install, scripts/postinstall.js reads installer-owned identity files it did not create — ~/.gitconfig, ~/.config/git/config,./.git/config (for the developer's git email) and ~/.config/gh/hosts.yml (for the GitHub CLI login and email) — and collects os.hostname(), os.userInfo().username, process.cwd(), and CI environment variables. The collected data is POSTed in plaintext JSON to https://npm-package-logger-228835561205.europe-west1.run.app/ (scripts/postinstall.js line 147 / line 163). Comments in the script claim the data is 'anonymous' and 'one-way hashed', but the traced payload ships the raw scmEmail, githubLogin, githubEmail, hostname, username, and cwd fields. The tarball additionally ships scripts/publish-versions.sh, whose comment 'This creates the appearance of an active, maintained package' documents a republish loop of 21 fake versions to manufacture apparent activity. The combination of typosquat naming against Vercel's AI SDK, install-time harvest of developer→employer identity from installer-managed git/GitHub config, exfiltration to a third-party Cloudflare Run endpoint, and the shipped version-spam script establishes a coordinated install-time identity-exfiltration campaign targeting AI/LLM developers. ## Source: ghsa-malware (e33e9e9c454638a63c5ef112aeb9e9abc2d805effd5dc0ceebf54746cf7ef327) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The ai-sdk-helpers npm package (versions including =0.1.0 through =1.4.4 as listed) is a malicious typosquat of the Vercel AI SDK. Its post-install script reads installer-owned git and GitHub CLI config files to extract developer email and login information, along with hostname, username, current working directory, and CI environment variables. This data is sent unencrypted in JSON format to a Cloudflare Run endpoint. The package also contains a script to create a false impression of active maintenance by republishing multiple fake versions. This establishes a coordinated install-time identity-exfiltration campaign targeting AI/LLM developers. The package should be removed, but full system compromise is likely, requiring secret rotation from a clean environment.
Potential Impact
Installation of this package results in exfiltration of sensitive developer and environment information, including git and GitHub credentials, hostname, username, and CI variables, to an attacker-controlled endpoint. This compromises developer identity and potentially employer-related secrets. The package's presence indicates likely full system compromise, meaning all secrets and keys stored on the affected computer should be considered exposed and rotated immediately. Removal of the package alone does not guarantee elimination of all malicious artifacts.
Mitigation Recommendations
No official patch or fix is available as this is a malicious typosquat package. The recommended mitigation is immediate removal of the ai-sdk-helpers package from all affected systems. Treat any system with this package installed as fully compromised. Rotate all secrets and keys from a separate, clean environment. Avoid installing packages from untrusted or suspicious sources, especially typosquatting variants. Monitor for and block network traffic to the identified exfiltration endpoint if possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5565
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a42ed6d27e9c79719938e9d
Added to database: 06/29/2026, 22:10:53 UTC
Last enriched: 07/08/2026, 15:07:07 UTC
Last updated: 07/29/2026, 21:35:30 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.