Loading story…
SafeDep identified a malicious npm supply-chain campaign that hid the ulid-xyz remote-access trojan three levels deep in a dependency chain. The operation used ioredis-xyz, a near-copy of the legitimate ioredis client, which depended on the nonfunctional relay package redis-type-xyz; version 1.10.6 of that relay then introduced ulid-xyz within a permissive version range. The payload's malicious postinstall hook established WebSocket command-and-control, conducted host and filesystem reconnaissance, accepted operator-provided binaries, and persisted as MicrosoftSystem64 across Windows, macOS, and Linux. npm removed ulid-xyz on August 25, 2026.
Infrastructure and operational overlaps—including port 8010, Hetzner-hosted infrastructure, shared persistence naming, and repository ownership—provide moderate-to-strong circumstantial links to the DPRK-linked FAMOUS CHOLLIMA / Contagious Interview cluster. No second-stage payload was found in the analyzed package archives, and the public attribution remains unconfirmed; however, organizations using the affected dependency chain should audit lockfiles and build artifacts for ioredis-xyz, redis-type-xyz, and ulid-xyz, and investigate systems for the MicrosoftSystem64 persistence artifact and unexpected WebSocket traffic.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
The lazarusholic Bluesky account posted about SafeDep's report on the ulid-xyz transitive-dependency campaign and suggested an association with Famous Chollima.
npm removed ulid-xyz under SafeDep advisory MAL-2026-6672.
SafeDep identified ulid-xyz, a typosquat of ulidx, as a malicious npm package and reported it under advisory MAL-2026-6672. Analysis found its postinstall hook launched a cross-platform remote-access payload through a three-package dependency chain.
SafeDep assessed the npm dependency-chain campaign as linked to the DPRK-associated FAMOUS CHOLLIMA/Contagious Interview cluster, citing shared MicrosoftSystem64 persistence naming, cross-platform design, port 8010, Hetzner infrastructure, and the whisdev developer persona. Its analysis also reported that 28 fabricated GitHub repositories promoted ioredis-xyz.
The analyzed command-and-control configuration identified 95.216.232.162:8010 as a later command server, also hosted by Hetzner Online GmbH in Germany.
The malware's command-and-control configuration identified 65.21.30.171:8010 as its command server. The server was hosted by Hetzner Online GmbH in Germany.
The redis-type-xyz package released version 1.10.6, adding ulid-xyz@^2.12.2 and activating a transitive chain from ioredis-xyz to the payload-bearing package. The permissive redis-type-xyz version range allowed the new malicious release to be resolved without republishing ioredis-xyz.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
bsky.app
Open sourcecyberveille.ch
Open sourcesafedep.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers tied a cluster of malicious npm packages to **FAMOUS CHOLLIMA**, linking typo-squatted and fake utility libraries including `bigmathix`, `bigmathex`, `bignumx`, `bigmathutils`, `axios-net`, `some-promise`, and `json-ptype` to a broader campaign aimed at developers, particularly in the cryptocurrency sector. ReversingLabs reported the activity as part of a fake recruiter operation targeting crypto developers, while separate analysis showed the packages delivered a multi-stage Node.js malware chain that ultimately installed a cross-platform JavaScript RAT capable of command execution, file theft, persistence on Windows, Linux, and macOS, self-deletion, and checks for the **MetaMask** browser extension. Multiple operational security failures exposed details of the operators’ workflow. Analysts found a stray Windows `.lnk` file embedded in packages published in May and June 2025, revealing a VMware-based build environment and a shared folder path tied to package development, while another package exposed an `err.log` file showing a Windows host, the username `dvant`, `Node.js v22.19.0`, and a local path suggesting direct modification of the legitimate `any-promise` package. A separate leaked `ordinary.txt` reference file contained commented test code, localhost references to port 4444, and logic for evaluating server-supplied content, reinforcing assessments that the same DPRK-linked operator or closely coordinated team reused infrastructure, payloads, and naming patterns across the npm supply-chain campaign.
Aug 14, 2026
More than 31 packages published under the **`@redhat-cloud-services`** npm scope were found carrying a multi-stage credential-stealing payload that executed automatically during installation through `preinstall` hooks. Researchers said the malware targeted GitHub and npm tokens, AWS, GCP, and Azure credentials, Kubernetes and HashiCorp Vault secrets, CircleCI data, and local environment details, with one analyzed package — **`@redhat-cloud-services/host-inventory-client@5.0.3`** — containing a 4.2 MB obfuscated harvester. The malicious releases were reportedly published via GitHub Actions OIDC from the `RedHatInsights/javascript-clients` repository, pointing to either compromise of the upstream CI/CD pipeline or abuse of its trust configuration; the affected packages collectively had roughly 116,000 weekly downloads. The incident emerged alongside a separate active npm dependency-confusion campaign identified by Microsoft, in which a single actor used spoofed organizational namespaces, inflated versions such as `100.100.100`, and obfuscated `postinstall.js` code to force installation of malicious packages in corporate developer environments. Microsoft said the payload currently focused on reconnaissance but could be switched remotely to steal credentials, exfiltrate data, or deploy a backdoor, and linked the activity to shared infrastructure and the domain `oob.moika.tech`. Registry teams removed the malicious packages, while defenders were urged to rotate exposed keys, enable **2FA**, audit lockfiles, downgrade to safe package versions, and consider disabling install scripts during npm package installation.
Jun 29, 2026
Security researchers reported two separate npm supply-chain compromises that delivered malware and exploit infrastructure to downstream users. One analysis uncovered an obfuscated Node.js stealer designed to run across **Windows via WSL, macOS, and Linux**, with plaintext modules for browser credential theft, recursive exfiltration of sensitive files, and a **WebSocket-based reverse shell**. The malware targeted Chromium-based browsers and cryptocurrency wallet extensions, sent browser data, files, and command traffic to `216.126.225.243` over ports `8085`, `8086`, and `8087`, and included host profiling plus an `HMAC-SHA256` routine with a hardcoded key. Researchers noted the command-and-control IP had previously been associated with **DPRK-linked OtterCookie** infrastructure. In a separate incident, Socket Threat Research said the widely used npm package **`art-template`** was compromised after repository control was transferred to an unknown actor, who inserted malicious remote-script loaders into versions **`4.13.5`** and **`4.13.6`**. The injected code redirected users to a watering-hole framework at `utaq.cfww.shop` that selectively targeted **Safari on iOS 11.0 through 17.2**, beaconed device and IP data to `l1ewsu3yjkqeroy.xyz`, and used anti-bot checks, anti-headless logic, and **WebAssembly-based fingerprinting** before retrieving gated payloads. Researchers found strong overlap with the **Coruna exploit kit**, including version-aware targeting, XOR obfuscation, architecture-specific dispatch, and a cutoff at **iOS 17.3**, with additional similarities noted to **UNC6691**.
Jun 29, 2026