The fake npm packages were live for 84 minutes. Someone published 40 of them on August 16, misspellings of libraries almost every JavaScript developer installs, and by 04:12 UTC the same morning they were gone. That looks like a takedown working.
It was not. The thing that actually stole from people was somewhere else, and nobody took it down for another 39 hours.
CloudSEK researcher Vikas Kundu published an analysis on August 20 of the campaign, which the firm calls BRIDGEHEAD. The packages impersonated chalk, axios, commander, lodash, react and typescript, and every one carried an install script that runs automatically when a developer installs it. But the script contains no malware. It is a courier.
The interesting part crosses out of Linux
The script profiles the machine, reports to a command server, then asks one question: is this Windows, or a Windows Subsystem for Linux environment running on top of Windows. WSL lets developers run a Linux shell on a Windows laptop, and most people treat that boundary as a wall. If the answer is yes, the script decodes a hidden instruction and reaches through that boundary, downloading and running a native Windows program the npm package never contained.
That program was not on npm at all. It sat as a release asset on GitHub, uploaded by an account called bebraz1 created in June, with its name and bio both set to the literal word null, under a release tag also named null.
Twenty-two megabytes, of which one percent is a program
The executable is 22 megabytes of Rust-compiled Windows code, and almost none of it is code. CloudSEK measured the actual program at 265 kilobytes, roughly one percent of the file. The rest is one unbroken run of 22,638,592 hexadecimal characters, an 11 megabyte encrypted payload written as plain text inside the binary. The outer program decodes it, decrypts it, and runs the result inside its own process. Nothing touches disk and no second process starts, so software watching for a dropped file or a suspicious child sees neither.
CloudSEK detonated it in an isolated environment and captured memory while it ran, which is how the target lists came out: 26 desktop cryptocurrency wallet paths, the saved credentials, cookies and history of Chromium-based browsers, and the session directory of Telegram Desktop. Exfiltration does not go to a criminal server. The stealer fingerprints the victim's public IP address and uploads to gofile[.]io, an anonymous file sharing service, so the data leaves through a legitimate host that cannot be seized like a malicious domain.
Two layers with opposite lifespans
CloudSEK describes the campaign as two layers with opposite lifespans: the npm layer loud, cheap and disposable, the payload layer quiet and durable. Removing 40 packages did nothing to the executable they pointed at. CloudSEK watched its download counter climb from 119 at 01:50 UTC on August 17 to 173 by 18:49 UTC the same day, 54 more pulls in under 17 hours, at a point when every package referencing it had been unpublished for over a day. The bebraz1 account returned 404 only a few hours after that reading. The command server at 193[.]70[.]34[.]101 was still answering on August 18, and probing the registry turned up three more campaign packages.
Developers who installed anything resembling those six library names around August 16 should treat the Windows host as compromised, not just the Linux side. Rotate browser-stored credentials, check cryptocurrency wallet files, and unlink existing Telegram Desktop sessions.
IntelFusions has covered several npm supply chain campaigns this month, including a worm set to sign its own malware with real provenance and hijacked packages that steal cloud keys. What separates this one is that the takedown everyone treats as the end of the story removed the least important half. CloudSEK's full analysis carries the hashes and the delivery chain.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.