Poisoned Pipeline / Incidents / AS83
ulid-xyz RAT via ioredis-xyz transitive chain
SafeDep reported ulid-xyz (OSV MAL-2026-6672) as a remote-access trojan
that reached developers as a third-level transitive of ioredis-xyz, a
copy of the real ioredis client planted in 28 attacker-created GitHub
repositories. The implant matches the DPRK-linked MicrosoftSystem64
cluster. Not a hijack of the real ulid or ioredis packages — a
lookalike dependency chain.
Mapped techniques
- T0129 Typosquatting
- T0109 Publish malicious artifact
- T0111 Malicious code contribution to an open-source repository
- T0172 Runtime backdoor
supply-chain three-deep typosquat chain
ioredis-xyz / ulid-xyz lookalikes, not the real packages.
RAT published as a transitive, not the top-level lure.
28 attacker GitHub repos depended on ioredis-xyz.
MicrosoftSystem64-family RAT.