Malicious code in ts-build-optimize (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (51c637ab7c13ca2f592502f3444ebb24b291422b6388563d04fb8f7ae9030d5a) The package masquerades as a TypeScript helper library (README is lifted from Microsoft's tslib and references --importHelpers, __extends, __assign, and a fake github.com/microsoft/ts-build-optimize/releases URL). The shipped index.js has nothing to do with TypeScript helpers: it exports a function `buildoptimize` whose default arguments are hardcoded to fetch `https://verceljs-kappa.vercel.app/icons/23` and pass the response body directly to `eval()` (index.js:61-63 sets `uuri = "https://verceljs-kappa.vercel.app/icons/"`; index.js:79 executes `eval(JSON.parse(b))`; the function is exported at index.js:95). Any consumer who imports this package and calls `buildoptimize()` — which the name and README imply is a build-time optimizer — will execute arbitrary attacker-controlled JavaScript on the installer/build machine. The Vercel destination is mutable (the author can swap the payload at any time), no hash or signature is verified, and the hosting domain is unrelated to Microsoft or any legitimate tslib publisher. The C2 endpoint serves a benign 6,758-byte PNG decoy when requested without the package's hardcoded `bearrtoken: logo` HTTP header (so casual scanners and `curl` see only an image), but returns 53,347 bytes of JSON-wrapped, heavily-obfuscated JavaScript when the header is present. Static analysis of the fetched second stage (sha256 of the raw response body fd082d2406d65aa78d5f1028e11dc23e85d63f07c459fb048d08236a65590b99; sha256 of the JSON-decoded JavaScript source 47d235dad37c7fb86e231822a4c231344cbd006e58b8cb9a013b064c1a521eb8 — captured 2026-05-15, payload is mutable) shows wallet-theft and persistence functionality: references to the Exodus cryptocurrency wallet on macOS (`/Library/Application Support/exodus.wallet`) and Windows (`/AppData/Roaming/Exodus/exodus.wallet`); functions named `installWindows`, `uninstallWindows`, `installMac`, `uninstallMac`, `isInstalledWindows`, and a `macPlistPath` constant indicating per-OS persistence install/uninstall machinery; heavy use of `child_process.execSync`/`exec` to invoke shell commands; and a top-level `setInterval(main, 30000)` re-execution loop. The combination of name-squat on a widely-used Microsoft package, README impersonation, header-gated decoy, and a remote-eval primitive that delivers wallet-theft + persistence makes this an unambiguous supply-chain attack. ## Source: ghsa-malware (4be8b286c06dccd79ec8f318a8f88f497e65c271c7f3e33b11a7ca4d53646b4e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The ts-build-optimize npm package impersonates a legitimate TypeScript helper library but contains malicious code that exports a function named buildoptimize. This function fetches JavaScript payloads from a remote Vercel-hosted URL and executes them via eval(), enabling arbitrary code execution on the build machine. The remote payload is obfuscated and includes functionality for stealing cryptocurrency wallets (specifically Exodus wallets on macOS and Windows), installing persistent malware with OS-specific install/uninstall functions, and repeatedly re-executing its main routine. The package uses a header-gated command and control server that serves a benign PNG image to casual requests but delivers malicious code when the expected header is present. This supply-chain attack leverages name-squatting and README impersonation to deceive users into installing it.
Potential Impact
Any system that installs or runs this package is fully compromised, allowing attackers to execute arbitrary code, steal cryptocurrency wallets, and establish persistent malware presence. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately. The attacker gains full control over the affected machine, and removal of the package alone may not eliminate all malicious components.
Mitigation Recommendations
No official patch or fix is available for this malicious package. Users should immediately remove ts-build-optimize versions 1.1.5, 1.1.6, 1.2.0, 1.2.1, and 1.2.2 from their environments. Because the package grants full system compromise, it is critical to assume the system is fully compromised and to rotate all secrets and keys from a separate, secure machine. Conduct a thorough incident response to identify and remove any persistent malware installed by this package.
Malicious code in ts-build-optimize (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (51c637ab7c13ca2f592502f3444ebb24b291422b6388563d04fb8f7ae9030d5a) The package masquerades as a TypeScript helper library (README is lifted from Microsoft's tslib and references --importHelpers, __extends, __assign, and a fake github.com/microsoft/ts-build-optimize/releases URL). The shipped index.js has nothing to do with TypeScript helpers: it exports a function `buildoptimize` whose default arguments are hardcoded to fetch `https://verceljs-kappa.vercel.app/icons/23` and pass the response body directly to `eval()` (index.js:61-63 sets `uuri = "https://verceljs-kappa.vercel.app/icons/"`; index.js:79 executes `eval(JSON.parse(b))`; the function is exported at index.js:95). Any consumer who imports this package and calls `buildoptimize()` — which the name and README imply is a build-time optimizer — will execute arbitrary attacker-controlled JavaScript on the installer/build machine. The Vercel destination is mutable (the author can swap the payload at any time), no hash or signature is verified, and the hosting domain is unrelated to Microsoft or any legitimate tslib publisher. The C2 endpoint serves a benign 6,758-byte PNG decoy when requested without the package's hardcoded `bearrtoken: logo` HTTP header (so casual scanners and `curl` see only an image), but returns 53,347 bytes of JSON-wrapped, heavily-obfuscated JavaScript when the header is present. Static analysis of the fetched second stage (sha256 of the raw response body fd082d2406d65aa78d5f1028e11dc23e85d63f07c459fb048d08236a65590b99; sha256 of the JSON-decoded JavaScript source 47d235dad37c7fb86e231822a4c231344cbd006e58b8cb9a013b064c1a521eb8 — captured 2026-05-15, payload is mutable) shows wallet-theft and persistence functionality: references to the Exodus cryptocurrency wallet on macOS (`/Library/Application Support/exodus.wallet`) and Windows (`/AppData/Roaming/Exodus/exodus.wallet`); functions named `installWindows`, `uninstallWindows`, `installMac`, `uninstallMac`, `isInstalledWindows`, and a `macPlistPath` constant indicating per-OS persistence install/uninstall machinery; heavy use of `child_process.execSync`/`exec` to invoke shell commands; and a top-level `setInterval(main, 30000)` re-execution loop. The combination of name-squat on a widely-used Microsoft package, README impersonation, header-gated decoy, and a remote-eval primitive that delivers wallet-theft + persistence makes this an unambiguous supply-chain attack. ## Source: ghsa-malware (4be8b286c06dccd79ec8f318a8f88f497e65c271c7f3e33b11a7ca4d53646b4e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The ts-build-optimize npm package impersonates a legitimate TypeScript helper library but contains malicious code that exports a function named buildoptimize. This function fetches JavaScript payloads from a remote Vercel-hosted URL and executes them via eval(), enabling arbitrary code execution on the build machine. The remote payload is obfuscated and includes functionality for stealing cryptocurrency wallets (specifically Exodus wallets on macOS and Windows), installing persistent malware with OS-specific install/uninstall functions, and repeatedly re-executing its main routine. The package uses a header-gated command and control server that serves a benign PNG image to casual requests but delivers malicious code when the expected header is present. This supply-chain attack leverages name-squatting and README impersonation to deceive users into installing it.
Potential Impact
Any system that installs or runs this package is fully compromised, allowing attackers to execute arbitrary code, steal cryptocurrency wallets, and establish persistent malware presence. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately. The attacker gains full control over the affected machine, and removal of the package alone may not eliminate all malicious components.
Mitigation Recommendations
No official patch or fix is available for this malicious package. Users should immediately remove ts-build-optimize versions 1.1.5, 1.1.6, 1.2.0, 1.2.1, and 1.2.2 from their environments. Because the package grants full system compromise, it is critical to assume the system is fully compromised and to rotate all secrets and keys from a separate, secure machine. Conduct a thorough incident response to identify and remove any persistent malware installed by this package.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-3774
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-c22w-53x6-4jf5"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4c341227e9c797195f7c98
Added to database: 07/06/2026, 23:02:42 UTC
Last enriched: 07/07/2026, 00:23:15 UTC
Last updated: 07/29/2026, 09:43:39 UTC
Views: 34
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.