Poisoned Pipeline

Poisoned Pipeline / Incidents / AS295

AS295 · 2026-09

DirtyBlanket fake Express/React packages spread a self-propagating Linux worm

npmLinux distro / packagesGit / GitHubAURCodeberg

SafeDep (29 Sep 2026): the npm account dirtyblanket published nine
packages in 33 minutes on 29 September 2026 — eight copying Express,
one copying React (xeprews, express-javascript, express-nodejs,
react-nodejs, exprdd, exprrdd, exptrdd, exptred, exptredd). Installing
any of them on Linux runs a preinstall hook that downloads node.js
through the Internet Archive Wayback Machine — the network sees
web.archive.org, which many allowlists trust, while the script is
unversioned and changeable — then downloads the worm linux.sh from
Codeberg and runs it. The worm installs the open-source CHAOS remote
access tool as a fake systemd font service (systemd-fontd /
systemd-fontrenderd under systemd directories, immutable flag as root,
Tor hidden service C2 with renamed config keys and InsecureSkipVerify),
giving the operator a shell, file access, and screenshots. It then
propagates three ways: SSH private keys against hosts in known_hosts,
new versions of AUR packages the machine's keys can push to, and npm
tokens in .npmrc used to publish infected versions of packages the
victim owns — restoring the original package.json afterwards so the
local tree shows no change. Each new host, AUR package, and npm version
restarts the chain.

Mapped techniques

supply-chain npm install-time worm

T0129 · Initial Access · Typosquatting

Eight Express and one React lookalikes under the dirtyblanket
account; versions track the real packages.

T0109 · Resource Development · Publish malicious artifact

Nine packages published from one throwaway account in 33
minutes.

T0151 · Execution · Installation scripts

The preinstall hook runs on every Linux install and pipes the
worm into bash.

T0205 · Initial Access · Compromise a third-party CDN or hosted web asset

The stage-one fetch is laundered through the Internet Archive
Wayback Machine so the network only sees web.archive.org, a
domain many allowlists trust; the Codeberg payload stays
reachable after the repository is removed.

T0207 · Defense Evasion · Skip or forge artifact integrity verification

The stage-one script is unversioned and unpinned, so it can be
swapped at any time; the worm restores the original
package.json after publishing so the local tree shows no
change.

T0176 · Defense Evasion · Disable or misconfigure security measures

The backdoor hides as a systemd font service with systemd-like
names, descriptions, and file locations, and sets the
immutable flag on its root-installed binary.

T0172 · Execution · Runtime backdoor

The CHAOS remote access tool runs as a systemd service over a
Tor hidden service with InsecureSkipVerify; shell, file
access, and screenshots.

post-supply-chain developer machines, SSH peers, AUR and npm consumers

T0184 · Credential Access · Harvesting sensitive information from files

Every SSH private key on the machine and npm tokens in .npmrc
files are harvested for propagation.

T0178 · Persistence · Deploy keys

Valid SSH keys are used to log in to every host in
known_hosts, so each peer keeps accepting the worm after the
original machine is cleaned.

T0169 · Lateral Movement · Push implants across repositories

npm tokens publish infected versions of packages the victim
owns, and git pushes poisoned AUR package builds; every new
version restarts the worm chain.

Sources