An npm typosquatting campaign crosses from WSL into Windows to plant a crypto-wallet stealer. The malware targets cryptocurrency wallets, browser credentials, cookies and Telegram sessions, executing largely in memory and using public infrastructure for reconnaissance and exfiltration. The campaign has two layers with opposite lifespans: the npm layer is loud, cheap and disposable, while the payload layer is quiet and durable.
The install script profiles the host, reports to a command-and-control server, and then asks one question: is this machine Windows, or a Windows Subsystem for Linux environment sitting on top of one. If the answer is yes, it decodes a hidden instruction and reaches across the boundary that normally separates a developer's Linux shell from the Windows host underneath it, downloading and running a native Windows executable that the npm package never contained.[/subscribe_to_unlock_form]
An npm typosquatting campaign crosses from WSL into Windows to plant a crypto-wallet stealer. The malware targets cryptocurrency wallets, browser credentials, cookies and Telegram sessions, executing largely in memory and using public infrastructure for reconnaissance and exfiltration. The campaign has two layers with opposite lifespans: the npm layer is loud, cheap and disposable, while the payload layer is quiet and durable.
The install script profiles the host, reports to a command-and-control server, and then asks one question: is this machine Windows, or a Windows Subsystem for Linux environment sitting on top of one. If the answer is yes, it decodes a hidden instruction and reaches across the boundary that normally separates a developer's Linux shell from the Windows host underneath it, downloading and running a native Windows executable that the npm package never contained.[emaillocker id="1283"]
This executable is a 22 megabyte Windows program written in Rust, hosted on GitHub. The payload executes almost immediately, is finished in well under a minute, and collects cryptocurrency wallet paths, browser credential material, and messenger-session data before attempting to upload it to an anonymous public file host.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial access | T1195.002 | Supply Chain Compromise | Compromise Software Supply Chain |
| Persistence | T1547.001 | Boot or Logon Autostart Execution | Registry Run Keys / Startup Folder |
| Defence Evasion | T1027.002 | Obfuscated Files or Information | Software Packing |
| Defence Evasion | T1070.004 | Indicator Removal | File Deletion |
| Credential access | T1555.003 | Credentials from Password Stores | Credentials from Web Browsers |
| Collection | T1005 | Data from Local System | - |
| Command and control | T1071.001 | Application Layer Protocol | Web Protocols |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | - |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Execution | E1204 | User Execution |
| Command & Control | B0030 | C2 Communication |
| Discovery | E1082 | System Information Discovery |
| Exfiltration | E1020 | Automated Exfiltration |
| Discovery | E1083 | File and Directory Discovery |
| Anti-Static Analysis | E1027 | Obfuscated Files or Information |
| Command & Control | E1105 | Ingress Tool Transfer |
| Anti-Static Analysis | B0032 | Executable Code Obfuscation |
The following reports contain further technical details:
[/emaillocker]