Poisoned Pipeline / Incidents / AS76
Typosquatted AI-tool npm packages under a real-identity publisher
OpenSourceMalware documented a July 2026 npm campaign of typosquatted
AI-tool packages that collected git, SSH, and cloud identity data in
install scripts and never needed to run at import time. Unlike typical
throwaway-account floods, packages were published under a coherent real
identity and iterated across at least five packages, including
@aspect-security/argon2 — a broken-shell package that only had to be
installed. Beacon traffic was dressed as telemetry. OSM’s point: install
time is code execution, and runtime scanners miss packages with no
runtime.
Mapped techniques
- T0129 Typosquatting
- T0109 Publish malicious artifact
- T0151 Installation scripts
- T0184 Harvesting sensitive information from files
supply-chain install-time telemetry stealers
AI-tool name lookalikes on npm.
Iterated across five packages under one identity, including @aspect-security/argon2.
Harvest happened at install; no runtime payload required.
git emails, SSH material, cloud configs, employer DNS.