EXECUTIVE SUMMARY:
The attack uses a malicious package published to a public code registry to deliver a post-exploitation agent. An attacker published a package with a name designed to resemble legitimate proxy-related modules and embedded a post-installation script that retrieves and launches a multi-platform post-exploitation agent. The delivery method abuses the software supply chain by executing code during package installation, letting the attacker place binaries or libraries directly on target systems. Affected systems include developer workstations, build hosts, and runtime servers across common desktop and server operating systems and across processor architectures. From a business standpoint, this undermines trust in open-source dependencies and can expose development pipelines, build systems, and production hosts that incorporate compromised modules. Once active on a host, the agent offers remote access, command execution, and file and process management, enabling escalation from a single compromised component to broader network activity.
The malicious package contains a post-installation script that fetches and executes an agent payload rather than embedding the full payload in the package. The script implements delivery paths tailored for three major operating system families and detects CPU architecture to retrieve appropriate payload variants. On one platform the script drops a dynamic library into a system directory and uses a legitimate system executable copied into that directory to load the malicious library, following a library sideloading pattern. On another platform the script writes an executable into a user autorun location and places a configuration manifest to trigger automatic launch at user login. On the third platform the script downloads an architecture-specific binary into a temporary folder, sets execute permissions and invokes it. The post-install script includes conditional checks and obfuscation and reaches out to external hosting to download the agent. After deployment, the agent exposes capabilities typical of post-exploitation frameworks: remote command execution, file and process control, mechanisms for persistence, and facilities to perform network reconnaissance and stage follow-on components.
This incident exemplifies supply-chain abuse where a package installer script retrieves and runs a powerful post-exploitation agent. By combining package distribution with scripted post-install behavior, a single compromised module can seed multiple hosts across development and production environments. The multi-platform delivery and CPU architecture checks demonstrate an intent to maximize compatibility and persistence, while library sideloading and autorun mechanisms show an emphasis on stealthy execution and long-term access. Technically, the intrusion grants remote control, data access and reconnaissance abilities consistent with advanced post-exploitation tooling, placing the event at the intersection of supply-chain compromise and direct malware deployment. The broader implication is that trusted open-source components can be weaponized to distribute sophisticated agents without traditional phishing or exploit chains, expanding the attack surface of software supply chains and development workflows.
THREAT PROFILE:
| Tactic | Technique ID | Technique |
| Resource Development | T1583 | Acquire infrastructure |
| Initial Access | T1195 | Supply chain compromise |
| Execution | T1059 | Command and scripting interpreter |
| Persistence | T1547 | Boot or logon autostart execution |
| Defense Evasion | T1574 | Hijack execution flow |
| Discovery | T1046 | Network service discovery |
| Collection | T1005 | Data from local system |
| Command and Control | T1071 | Application layer protocol |
REFERENCES:
The following reports contain further technical details:
https://securelist.com/adaptixc2-agent-found-in-an-npm-package/117784/