Typosquatting npm Packages Steal Cloud and CI/CD Secrets

Key Takeaways

• A new typosquatting campaign on the npm registry deployed 14 malicious packages in a four-hour window.
• These packages steal sensitive cloud credentials, CI/CD pipeline secrets, and npm publish tokens from developer machines.
• The attacks use sophisticated techniques, including a stealthy second-generation payload that bundles the Bun runtime to avoid detection.
• Stolen npm publish tokens pose a significant supply chain risk, enabling attackers to inject malicious code into legitimate projects.
• Immediate action is required for any systems that installed the affected packages on or after May 28, 2026.

A sophisticated new threat targeting the open-source software supply chain has been identified, involving malicious npm packages designed to exfiltrate critical cloud and CI/CD secrets from developer environments. Uncovered on May 28, 2026, this campaign highlights the persistent vulnerability of the software ecosystem to attacks leveraging simple human error with alarming efficiency.

The attackers employed a typosquatting strategy, publishing packages with names meticulously crafted to resemble popular and trusted libraries. This tactic exploits common misspellings or slight variations that developers might overlook, leading to the accidental installation of dangerous code.

In a rapid deployment, 14 malicious packages appeared on the npm registry within a mere four-hour period. These packages mimicked widely used tools associated with OpenSearch, ElasticSearch, DevOps, and environment configuration. Upon installation, they immediately began harvesting sensitive credentials, transmitting them to attacker-controlled infrastructure without any overt signs of compromise to the victim.

Threat Actor and Payload Details

Microsoft analysts, who identified and reported on the campaign, attributed all 14 packages to a single threat actor operating under the npm maintainer alias “vpmdhaj.” This alias was registered with the email address a39155771@gmail[.]com. In a report shared with Cyber Security News (CSN), Microsoft detailed that all packages shared an identical credential-harvesting payload: a ~195 KB Bun-compiled binary specifically engineered to target cloud and CI/CD environments.

To enhance their deceptive appearance, the malicious packages utilized spoofed metadata, directing their homepage and repository fields to point to the legitimate OpenSearch project. This made them appear trustworthy at a glance, increasing the likelihood of successful installation.

The scope of data targeted by these packages is extensive, including AWS credentials, HashiCorp Vault tokens, GitHub Actions tokens, and crucially, npm publish tokens. The theft of npm publish tokens is particularly concerning, as it could enable attackers to push malicious updates to other legitimate packages. This would transform a single compromised developer workstation into a launchpad for a much broader and more destructive supply chain attack, expanding the campaign’s reach far beyond the initial 14 packages.

Attack Execution and Evolving Stealth

The attack initiates the moment a developer executes npm install. Each malicious package incorporates an automatic lifecycle hook, triggering the harmful code without requiring any further user interaction. Two distinct variants of this initial “stager” have been observed.

The older generation of the stager communicated with an external command-and-control (C2) server to retrieve its malicious payload. However, a newer, more stealthy generation has emerged. This advanced variant silently downloads the legitimate Bun runtime and uses it to execute a pre-bundled malicious script hidden within the npm tarball itself.

This newer variant is particularly insidious because it bypasses conventional security monitoring tools that might flag suspicious outbound network traffic at install time. By leveraging a legitimate runtime to execute its payload internally, it avoids obvious indicators of compromise. The second-stage binary then proceeds to scan across 16 or more AWS regions, queries the EC2 metadata service, reads environment variables, and checks for execution within a GitHub Actions pipeline. This reconnaissance allows it to prioritize credential collection based on the specific environment and available targets.

Downstream Supply Chain Expansion Risk

What differentiates this campaign from typical credential theft operations is its explicit targeting of npm publish tokens. Gaining control over a legitimate developer’s ability to publish packages allows an attacker to inject malicious code into trusted libraries without the owner’s knowledge. This capability presents a significant downstream risk, potentially rippling out to thousands of other projects that depend on the compromised libraries, vastly expanding the campaign’s impact beyond the initial cluster of 14 malicious packages.

What You Should Do

• Immediate Credential Rotation: If any of the affected packages were installed on or after May 28, 2026, immediately rotate all AWS, HashiCorp Vault, npm, and GitHub credentials that may have been exposed.
• Network Egress Blocking: Block egress traffic to the attacker’s C2 domain (aab.sportsontheweb[.]net) at the firewall and DNS levels.
• CI/CD Log Review: Thoroughly review CI/CD build logs for any unexpected network connections or unusual Bun runtime downloads initiated by Node.js processes.
• Use --ignore-scripts: When running npm install, utilize the --ignore-scripts flag to prevent lifecycle hooks from executing, thereby stopping the attack at its earliest entry point before any payload reaches disk.
• Monitor for Indicators of Compromise (IoCs):
  • npm Packages:
    • @vpmdhaj/elastic-helper (1.0.7269)
    • @vpmdhaj/devops-tools (1.0.7267)
    • @vpmdhaj/opensearch-setup (1.0.7267)
    • @vpmdhaj/search-setup (1.0.7268)
    • opensearch-security-scanner (1.0.10)
    • opensearch-setup (1.0.9103)
    • opensearch-setup-tool (1.0.9108)
    • opensearch-config-utility (1.0.9106)
    • search-engine-setup (1.0.9108)
    • search-cluster-setup (1.0.9104)
    • elastic-opensearch-helper (1.0.9108)
    • vpmdhaj-opensearch-setup (1.0.9102)
    • env-config-manager (2.1.9201)
    • app-config-utility (1.0.9300)
  • npm Maintainer: vpmdhaj
  • Email: a39155771@gmail[.]com
  • C2 Domain: aab.sportsontheweb[.]net
  • C2 URL: hxxp://aab.sportsontheweb[.]net/x.php
  • HTTP Header: X-Supply: 1
  • IP Addresses: 169.254.169.254 (AWS EC2 IMDSv2), 169.254.170.2 (AWS ECS task metadata)
  • SHA-256 Hashes:
    • 638788AFC4F1B5860A328312CAF5895ABD5F5632D28A4F2A85B09076E270D15D (preinstall.js – Gen-1 stager)
    • 77D92EFE7AF3547F71FD41D4A884872D66B1BE9499EAA637E91EAC866911694D (setup.mjs – Gen-2 stager)
    • BFA149694EC6411C23936311A999163ADE54D6F38E2F4B0E3CFB8CB67BD7CFAA (payload.gz – gzipped Bun stage-2 binary)
  • Filenames: opensearch_init.js, ai_init.js, payload.bin
  • Environment Variable: __DAEMONIZED=1

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.