Poisoned Pipeline

Poisoned Pipeline / Incidents / AS114

AS114 · 2026-08

BRIDGEHEAD npm typosquats jump WSL to a Windows wallet stealer

npmWindows softwareLinux distro / packagesGit / GitHub

CloudSEK (20 Aug 2026): forty npm typosquats of chalk, axios, commander,
lodash, react and typescript. Each install script profiled the host and,
if it was Windows or WSL, reached across into the Windows host and ran
a 22MB Rust wrapper from a GitHub release. 98.6% of that file was an
in-memory encrypted payload (no drop on disk). npm packages were
removed; the GitHub asset stayed up ~39 hours and kept being downloaded.
Targets: crypto wallets, browser creds, cookies, Telegram sessions.

Mapped techniques

supply-chain wsl bridge

T0129 · Initial Access · Typosquatting

40 misspellings of chalk, axios, commander, lodash, react, typescript.

T0151 · Execution · Installation scripts

Courier script; real payload fetched from GitHub releases.

T0153 · Initial Access · Compromised developer workstation

WSL install reached the Windows host underneath.

T0184 · Credential Access · Harvesting sensitive information from files

Wallets, browser creds, cookies, Telegram sessions.

Sources