Threats Tagged 'mal-2026-6275'

The npm package @ts-apis/ts-utils contains a malicious backdoor in its published dist/index.js file that executes an obfuscated payload at require() time. This payload harvests a wide range of sensitive credentials and configuration files from the host system, including SSH keys, AWS, Kubernetes, Docker, Git, Google Cloud, Terraform, Azure, Vault, Railway, Solana credentials, environment files, and Linux secrets. It also queries cloud instance metadata services to steal short-lived credentials. The stolen data is encoded and exfiltrated via HTTPS to a remote server. Additionally, the malware establishes a persistent command-and-control channel that can download and execute further malicious binaries and run arbitrary shell commands. The malicious code is deliberately hidden in the distributed build, while the source directory contains only legitimate code, indicating a supply chain compromise. Any system with this package installed should be considered fully compromised.