Malicious, typosquatted npm packages impersonating Anthropic, OpenAI, Vercel, LangChain, Ollama and Aspect Security were found to collect attribute data from developer machines during npm install and send it to an external endpoint. The author is said to be the founder of an Israeli cybersecurity startup whose name has not been disclosed.
April–June 2026 · npm Supply Chain
Fake AI Packages Harvested Developer Identities — Not Passwords
Malicious npm packages typosquatting Anthropic, OpenAI, Vercel, LangChain and Ollama ran silently at install time — collecting 11 categories of attribute data to build an "identity graph" for future spear-phishing, then quietly exfiltrating it.
~20,000
Downloads before detection & removal
~7
Impersonating packages published
11
Categories of attribute data harvested
Payload Evolution
A 601-byte script grew into a 16KB obfuscation engine
→
16 KB · 461 lines
Refined version
Added error suppression, a 5-second timeout, disguised opt-out naming, and "alibi" TS files that never execute — built to survive a visual code review.
The Attack Chain
Typosquat install
Names mimic anthropic-toolkit, ai-sdk-helpers, @langgraphjs/toolkit
→
postinstall runs
Script fires automatically during npm install
→
Harvest identity
Hostname, Git emails, SSH comments, cloud config, CI signals
→
Exfiltrate
JSON sent to a Google Cloud Run endpoint — TLS-terminated, allowlist-friendly
Not credential theft — identity mapping
No passwords or API tokens were stolen. Instead the goal was an "identity graph" to identify teammates and pivot to targeted spear-phishing. The reported author: the founder of an Israeli cybersecurity startup.
Git emails (up to ~15)
SSH key comments
AWS / GCP config
Corporate DNS domains
CI environment detection
Defend
Disable install scripts: npm config set ignore-scripts true
Scan dependencies with tools like Socket.dev and Snyk
Verify package names — don't trust them blindly
Watch out
Rising npm supply-chain attacks (Shai-Hulud, TanStack chaos)
"Slopsquatting" — LLM-hallucinated package names
Risk of trusting AI-suggested dependencies unconditionally
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article…