Poisoned Pipeline

Poisoned Pipeline / Incidents / AS103

AS103 · 2026-04

Typosquat npm packages backdoor Claude Code SessionStart

npmAI coding agentsLinux distro / packagesGit / GitHub

SafeDep: five typosquatting npm packages shipped a hidden ELF binary
that fires on install and re-runs via Claude Code’s SessionStart hook
on every developer session. Persistence in the AI-agent lifecycle,
not only npm postinstall (T0210).

Mapped techniques

supply-chain agent hook persistence

T0129 · Initial Access · Typosquatting

Five lookalike npm packages.

T0151 · Execution · Installation scripts

Hidden ELF runs at install.

T0210 · Persistence · Poison AI coding-agent config or workspace

Claude Code SessionStart hook re-runs the payload.

Sources