Poisoned Pipeline / Incidents / AS294
VHX Harvester panel ran npm typosquat recon into a vast.ai GPU-cloud intrusion
npmLinux distro / packagesAI coding agents
CloudSEK (TOPHIT Part 2, 29 Sep 2026): the @prime0 npm typosquat
infrastructure from GTI-TOPHIT (85 packages beaconing to
69.48.229.140:8080 on install) hosts a second service on port 80 — a
purpose-built offensive panel, VHX Harvester 0.1.0. As of 25 September
2026 the panel had enumerated 297 host IPs from the vast.ai public API,
scanned 13,368 service endpoints across them, exfiltrated metadata from
416 services, deployed 25 bridge agents onto rented GPU instances, and
achieved one confirmed root shell on a victim's Jupyter notebook. No
miners were planted and the operation is in its development phase. A
misconfiguration exposed the panel: 17 API endpoints require no
authentication, including agent/code.tar.gz, which serves the complete
C2 agent source with hardcoded default credentials. The source reveals
an eight-phase kill chain: enumerate GPU hosts from the marketplace API,
scan their port ranges, classify and fingerprint services, harvest
credentials and metadata, inject stored XSS into vast.ai's Caddy auth
portals to steal session tokens, rent cheap containers on the same
physical host as the target to scan the Docker bridge, access
unprotected Jupyter notebooks for root shells, and deploy miners onto
hijacked instances. New technique T0214 (rent co-located containers to
scan an isolated network) is recorded for the bridge-agent model;
stored XSS into the Caddy auth proxy's error logs and npm typosquats as
the discovery vector for GPU infrastructure are recorded as gaps.
Mapped techniques
- T0129 Typosquatting
- T0103 Scan public artifacts for secrets
- T0180 Compromise services / servers
- T0214 Rent co-located containers to scan an isolated network
- T0119 Cross-site scripting
supply-chain npm typosquat infrastructure
85 packages under the @prime0 scope, beaconing to
69.48.229.140:8080 at install; the npm typosquats are also the
discovery vector that led to the GPU infrastructure.
297 host IPs enumerated from the vast.ai public API and
marketplace listings before any victim contact.
post-supply-chain vast.ai tenants
One confirmed root shell on a victim's Jupyter notebook;
metadata exfiltrated from 416 services.
25 bridge agents rented legitimate containers on the same
physical host as the targets to scan the Docker bridge
(172.17.0.0/16) from inside the trust boundary.
Stored XSS injected into the Caddy auth proxy's error logs to
steal tenant session tokens.
Framework gaps noted
- Stored XSS injected into a reverse-proxy auth portal's error logs has no dedicated technique; T0119 (XSS) records the behaviour here.
- npm typosquats used as the discovery vector for cloud infrastructure (rather than code theft) are recorded explicitly instead of force-mapping an existing technique.