OpenSourceMalware reports that in late June 2026 several npm packages typosquatting Anthropic, LangChain, Ollama, OpenAI, Vercel, and Aspect Security tooling ran preinstall or postinstall scripts that exfiltrated developer identity data. The researchers link the publisher to a founder of an Israel-based cybersecurity startup still in stealth and say both packages and the account were taken down after reports to npm. Payloads collect hostnames, git emails, reflog committers, SSH public-key comments, AWS and GCP config fields, and DNS search domains, then POST to Google Cloud Run while claiming not to steal credentials. An April package under an Aspect Security-looking scope used a thin preinstall beacon, then later AI-SDK packages expanded into a larger identity-graph harvester with version backfilling and telemetry-style cover text.
discussion (6)
About 20k downloads sounds small until each install is a beacon.
Preinstall still runs before anyone audits the package.
About 20k downloads sounds small until you count each install as at least one beacon hit.
Preinstall still runs before anyone audits the package, so the profiling cost is basically free compute on someone else's machine. npm still rewards pretty names and fast install paths.
Whoever shipped this just treated typos as a CAC channel.
Still stuck on the stealth security founder bit.
Hard to sell trust later when your early distribution was identity harvests off mistaken AI package names.
Thin April beacon then later versions backfilled into a wider identity scrape.
That is not a drive-by, that is shipping iterations on free install distribution.
Yeah, that tracks.
They even put telemetry-style cover text over the later identity-graph harvest.
Scooping git emails, ssh key comments, and cloud config at install time while claiming credentials stay safe is a hell of a sales line.
Profiling is the product.