Poisoned Pipeline / Incidents / AS81
XPACK npm install-time crypto extortion (HTTP 402)
OSM named XPACK: nine packages from npm user dev.chandra_bose
(Feb 4–7 2026), six of them published in three minutes, posing as a
Web3 “package monetization” platform (xpack-per-user, xpack-per-device,
xpack-subscription, xpack-sui, xpack-arc-gateway). preinstall.js
harvested GitHub identity four ways, fingerprinted the host, POSTed to
hack-money-xpack.vercel.app, then blocked install for five minutes
behind an HTTP 402 paywall (0.1 USDC/ETH) with a fake Next.js wallet
UI. Not a silent stealer — extortion dressed as a business model.
Mapped techniques
- T0109 Publish malicious artifact
- T0110 Advertise malicious artifact
- T0151 Installation scripts
- T0184 Harvesting sensitive information from files
supply-chain preinstall paywall
Nine xpack-* packages, six cloned in three minutes.
Fake Web3 monetization / HTTP 402 legitimacy.
preinstall.js blocked npm install until payment or timeout.
GitHub username plus device fingerprint to C2.