Malicious code in ulid-xyz (npm)
ulid-xyz is a typosquat of the popular ulid library (sortable unique IDs) and is a cross-platform Remote Access Trojan delivered via a postinstall hook. The package.json postinstall superficially looks like an inline `node -e` guard that checks for the existence of a dist file, but it actually launches dist/node/utils.js as a detached background process, which in turn runs dist/node/payload.js -- a 467 KB bundled RAT. payload.js decodes XOR+base64-obfuscated configuration (_CFG.WS / _CFG.HTTP) to beacon to a hardcoded attacker-controlled C2 over WebSocket at ws://95.216.232.162:8010/ (with an HTTP fallback at http://95.216.232.162:8010/), establishing a WebSocket RAT channel. It installs persistence on all three major operating systems under the stem MicrosoftSystem64: on Windows under %LOCALAPPDATA%\MicrosoftSystem64; on macOS under ~/Library/Application Support/MicrosoftSystem64 plus a LaunchAgent at ~/Library/LaunchAgents/com.launchkeeper.MicrosoftSystem64.plist; and on Linux under ~/.local/share/MicrosoftSystem64. The install-time detached spawn (process management capability) and the ~8x package size spike (64 KB to 536 KB) correspond to the bundled RAT payload -- behavior a ULID library has no legitimate need for. All versions of ulid-xyz were published by the same actor (iloiyxo643 / [email protected], a disposable email address) and are considered malicious. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (23041702700830f3caa094b14bf923ac78f81d6d0cef96ec784e948dbe4fc705) Package publishes as 'ulid-xyz' — a name edit away from the established 'ulidx' / 'ulid' libraries — and its README instructs users to `npm install index-ulid` and `import { ulid } from "index-ulid"`, pointing at a second confusable name maintained by the same author. The declared homepage links to the canonical ulid repository (github.com/ulid/javascript), reinforcing the impersonation. package.json declares `scripts.postinstall` that runs `node dist/node/utils.js` after a required-files guard, but `dist/node/utils.js` is absent from this tarball — only `dist/node/index.cjs` and `dist/node/index.js` ship. As published, the guard throws and the postinstall is inert, so no malicious code executes on install in this version. The wired-but-missing lifecycle target combined with the confusable name and a bloated runtime dependency list (pino, ws, zod, esbuild, tsup, ts-node, typescript, @types/node, @types/ws, and a meta `postinstall` package — none required for ULID generation, where the legitimate ulidx ships zero runtime deps) is consistent with a dormant-dropper staging pattern: ship a benign tarball under a confusable name, then publish a future version that fills in the postinstall target. No exfiltration, no install-time RCE, and no silent-relay are present in the current code, so a public block would overclaim the present-version harm. Routing to human review for confusion-risk assessment and so a reviewer can monitor future versions of this name.
AI Analysis
Technical Summary
The 'ulid-xyz' npm package is a typosquatting threat targeting users expecting the legitimate 'ulid' library. It includes a postinstall lifecycle script that, when fully implemented, launches a detached background process running a large bundled RAT payload. This RAT uses XOR and base64 obfuscation to configure and beacon to a hardcoded WebSocket and HTTP C2 server at IP 95.216.232.162:8010. It establishes a persistent backdoor on Windows, macOS, and Linux by installing under 'MicrosoftSystem64' directories and setting up a LaunchAgent on macOS. The current published versions (3.2.3, 3.2.4, 3.1.0, 2.12.1, 3.2.2, 3.2.1) ship a benign tarball with a missing postinstall target file, rendering the malicious code inactive for now. However, the package's naming, dependency bloat, and staged dropper pattern indicate intent to activate malicious behavior in future updates.
Potential Impact
If the malicious postinstall hook were activated, it would execute a Remote Access Trojan capable of establishing a persistent backdoor on affected systems across major operating systems. This would allow attackers to maintain remote control, potentially leading to unauthorized access, data exfiltration, or further compromise. Currently, no active exploitation or install-time remote code execution occurs in the published versions, but the package poses a high risk if future versions enable the dormant payload.
Mitigation Recommendations
Avoid using the 'ulid-xyz' package entirely, as all published versions are malicious. Prefer the legitimate 'ulid' or 'ulidx' libraries from trusted sources. Monitor for any updates or new versions of 'ulid-xyz' that may activate the malicious payload. Since the current versions have an inert postinstall hook, no immediate remediation is required beyond avoiding installation. There is no official patch or fix because this is a malicious package rather than a vulnerability in legitimate software.
Malicious code in ulid-xyz (npm)
Description
ulid-xyz is a typosquat of the popular ulid library (sortable unique IDs) and is a cross-platform Remote Access Trojan delivered via a postinstall hook. The package.json postinstall superficially looks like an inline `node -e` guard that checks for the existence of a dist file, but it actually launches dist/node/utils.js as a detached background process, which in turn runs dist/node/payload.js -- a 467 KB bundled RAT. payload.js decodes XOR+base64-obfuscated configuration (_CFG.WS / _CFG.HTTP) to beacon to a hardcoded attacker-controlled C2 over WebSocket at ws://95.216.232.162:8010/ (with an HTTP fallback at http://95.216.232.162:8010/), establishing a WebSocket RAT channel. It installs persistence on all three major operating systems under the stem MicrosoftSystem64: on Windows under %LOCALAPPDATA%\MicrosoftSystem64; on macOS under ~/Library/Application Support/MicrosoftSystem64 plus a LaunchAgent at ~/Library/LaunchAgents/com.launchkeeper.MicrosoftSystem64.plist; and on Linux under ~/.local/share/MicrosoftSystem64. The install-time detached spawn (process management capability) and the ~8x package size spike (64 KB to 536 KB) correspond to the bundled RAT payload -- behavior a ULID library has no legitimate need for. All versions of ulid-xyz were published by the same actor (iloiyxo643 / [email protected], a disposable email address) and are considered malicious. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (23041702700830f3caa094b14bf923ac78f81d6d0cef96ec784e948dbe4fc705) Package publishes as 'ulid-xyz' — a name edit away from the established 'ulidx' / 'ulid' libraries — and its README instructs users to `npm install index-ulid` and `import { ulid } from "index-ulid"`, pointing at a second confusable name maintained by the same author. The declared homepage links to the canonical ulid repository (github.com/ulid/javascript), reinforcing the impersonation. package.json declares `scripts.postinstall` that runs `node dist/node/utils.js` after a required-files guard, but `dist/node/utils.js` is absent from this tarball — only `dist/node/index.cjs` and `dist/node/index.js` ship. As published, the guard throws and the postinstall is inert, so no malicious code executes on install in this version. The wired-but-missing lifecycle target combined with the confusable name and a bloated runtime dependency list (pino, ws, zod, esbuild, tsup, ts-node, typescript, @types/node, @types/ws, and a meta `postinstall` package — none required for ULID generation, where the legitimate ulidx ships zero runtime deps) is consistent with a dormant-dropper staging pattern: ship a benign tarball under a confusable name, then publish a future version that fills in the postinstall target. No exfiltration, no install-time RCE, and no silent-relay are present in the current code, so a public block would overclaim the present-version harm. Routing to human review for confusion-risk assessment and so a reviewer can monitor future versions of this name.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'ulid-xyz' npm package is a typosquatting threat targeting users expecting the legitimate 'ulid' library. It includes a postinstall lifecycle script that, when fully implemented, launches a detached background process running a large bundled RAT payload. This RAT uses XOR and base64 obfuscation to configure and beacon to a hardcoded WebSocket and HTTP C2 server at IP 95.216.232.162:8010. It establishes a persistent backdoor on Windows, macOS, and Linux by installing under 'MicrosoftSystem64' directories and setting up a LaunchAgent on macOS. The current published versions (3.2.3, 3.2.4, 3.1.0, 2.12.1, 3.2.2, 3.2.1) ship a benign tarball with a missing postinstall target file, rendering the malicious code inactive for now. However, the package's naming, dependency bloat, and staged dropper pattern indicate intent to activate malicious behavior in future updates.
Potential Impact
If the malicious postinstall hook were activated, it would execute a Remote Access Trojan capable of establishing a persistent backdoor on affected systems across major operating systems. This would allow attackers to maintain remote control, potentially leading to unauthorized access, data exfiltration, or further compromise. Currently, no active exploitation or install-time remote code execution occurs in the published versions, but the package poses a high risk if future versions enable the dormant payload.
Mitigation Recommendations
Avoid using the 'ulid-xyz' package entirely, as all published versions are malicious. Prefer the legitimate 'ulid' or 'ulidx' libraries from trusted sources. Monitor for any updates or new versions of 'ulid-xyz' that may activate the malicious payload. Since the current versions have an inert postinstall hook, no immediate remediation is required beyond avoiding installation. There is no official patch or fix because this is a malicious package rather than a vulnerability in legitimate software.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6672
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4f6c3668715ace4315870c
Added to database: 07/09/2026, 09:39:02 UTC
Last enriched: 07/09/2026, 09:52:04 UTC
Last updated: 07/29/2026, 04:00:44 UTC
Views: 27
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.