In August 2026, forty npm typosquatting packages were used as couriers to deliver a Windows payload from a GitHub account named bebraz1, with a WSL-aware install script bridging from a developer’s Linux shell to the Windows host underneath. The delivered Rust-based wrapper unpacked an encrypted in-memory stealer that targeted cryptocurrency wallets, Chromium browser credentials, and Telegram sessions, then attempted to exfiltrate data through upload.gofile.io after fingerprinting the victim via api.ipify.org. #bebraz1 #main.exe #gofile.io #api.ipify.org #WSL
Keypoints
- Forty npm packages were published as typosquats or namespace-squats of popular libraries such as chalk, axios, commander, lodash, react, and typescript.
- Each package included an install hook that acted as a beacon and collected limited host telemetry before contacting a hardcoded C2 server.
- The install script checked whether the host was Windows or Windows Subsystem for Linux, allowing the campaign to cross from a Linux shell into the underlying Windows system.
- If the WSL gate passed, the script decoded hidden instructions and downloaded a Windows executable from GitHub, then launched it without a visible window.
- The GitHub payload, main.exe, was a Rust-based delivery wrapper containing an encrypted 11 MB stage stored as hexadecimal text inside its .rdata section.
- The unpacked stage ran entirely in memory, fingerprinted the victim’s IP and hardware, and targeted desktop cryptocurrency wallets, Chromium browser data, and Telegram Desktop session stores.
- The only live operator infrastructure observed at reporting time was the C2 server at 193.70.34.101:20099, while the npm packages and GitHub payload account had been removed.
MITRE Techniques
- [T1078 ] Valid Accounts – The campaign targets stolen browser sessions and wallet-access material that can enable account reuse and takeover (‘browser-credential and messenger-session stealer’).
- [T1057 ] Process Discovery – The payload samples the process list to observe its own execution and absence of descendants (‘process list, sampled once a second’).
- [T1082 ] System Information Discovery – The dropper profiles host details such as platform, architecture, Node version, and hardware information (‘Node version, architecture, platform’ / ‘CPU: Intel(R) Xeon… GPU… RAM’).
- [T1016 ] System Network Configuration Discovery – The malware fingerprints the victim by resolving and using api.ipify.org to learn the external IP address (‘public-IP reconnaissance’).
- [T1049 ] System Network Connections Discovery – The install script and payload enumerate network-relevant host context and communicate with C2/exfiltration endpoints (‘reports to a command-and-control server’ / ‘attempts to upload to gofile.io’).
- [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – The wrapper performs timing-based stalling and checks whether it is running in WSL before deploying the payload (‘a loop that computes nothing exists to consume time’ / ‘isVirtualizedLinux’).
- [T1027 ] Obfuscated Files or Information – The payload URL and commands are XOR-encoded in the npm package, and the Windows payload is stored as one long hexadecimal string (‘decodes a hidden instruction’ / ‘single unbroken run of hexadecimal characters’).
- [T1105 ] Ingress Tool Transfer – The script downloads the Windows executable from GitHub and runs it locally (‘downloading and running a native Windows executable’).
- [T1204.002 ] User Execution: Malicious File – The attack is triggered during npm install via an install hook (‘Installing any of them runs scripts/postinstall.js automatically’).
- [T1059.001 ] Command and Scripting Interpreter: PowerShell – In the WSL branch, the install script launches hidden PowerShell to download and execute the payload (‘powershell.exe -WindowStyle Hidden -NoProfile -NonInteractive -ExecutionPolicy Bypass’).
- [T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – The wrapper includes a cmd.exe invocation as part of its unpacking/runtime behavior (‘cmd.exe /e:ON /v:OFF /d /c’).
- [T1106 ] Native API – The payload uses Windows-native capabilities such as DPAPI and raw sockets rather than managed runtime libraries (‘crypt32.dll dpapi.dll’ / ‘ws2_32.dll raw sockets’).
- [T1102.001 ] Web Service: Generic Web Service – The campaign uses legitimate public services for reconnaissance and exfiltration, namely api.ipify.org and upload.gofile.io (‘public-IP lookup’ / ‘Anonymous file-sharing service’).
- [T1021.005 ] Remote Services: VNC – Not mentioned.
Indicators of Compromise
- [SHA-256 ] main.exe wrapper and embedded encrypted stage – 6f088ade49456db2422c3edfbb9998f4a3e9cce7c4c00a7279fb45d672a82b7d, 6888d4c54ef2b5bf23889f9637c2efe77e1d2af4724d315b73d646cf5547dc73
- [IP address ] operator C2 and install beacon – 193.70.34.101, port 20099
- [URL ] payload hosting and delivery – https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe, https://github.com/bebraz1/qPzM50V1AKG0rVlH
- [Domain ] reconnaissance and exfiltration services – api.ipify.org, upload.gofile.io
- [File name ] payload drop target and wrapper artifact – main.exe, scripts/postinstall.js
- [File path ] Windows payload drop target and host artefacts – %TEMP%main.exe, /proc/version, /proc/sys/kernel/osrelease
- [GitHub account ] payload publisher account – bebraz1
Read more: https://www.cloudsek.com/blog/bridgehead-npm-typosquatting-wsl-windows-crypto-wallet-stealer