33 Malicious npm Packages Abuse Dependency Confusion to Profile Developer Environments (oob.moika[.]tech C2)
33 Malicious npm Packages Abuse Dependency Confusion to (TL-2026-0633), also tracked as moika.tech npm campaign, is a high-severity supply-chain compromise, first published 2026-05-29. It has no confirmed attribution, affects npm (OpenJS / GitHub) npm public registry, maps to 18 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-0633
- Threat ID
- TL-2026-0633
- Also known as
- moika.tech npm campaign, oob.moika.tech dependency confusion campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-05-29
- Last reviewed
- 2026-05-29
- Attribution confidence
- NONE
- Motivation
- ESPIONAGE
- Target sectors
- technology, financial, e-commerce, cloud, software-development, retail
- Target regions
- Russia, CIS, Eastern Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 30
Microsoft Threat Intelligence uncovered an active npm supply-chain campaign in which a single operator using three maintainer aliases (mr.4nd3r50n, ce-rwb, t-in-one) published 33 malicious packages on May 28-29, 2026 across nine organizational scopes that mirror real internal corporate namespaces, exploiting dependency confusion. Every package ships an identical obfuscated postinstall stager that fetches a ~17KB platform-specific JavaScript reconnaissance dropper from C2 oob.moika[.]tech (72.56.97.200, Timeweb AS210976), fingerprinting developer environments and harvesting credentials and context. A server-toggleable RECON_ONLY flag, hard-coded to 1, stages the operation for selective follow-on full exploitation. npm removed the packages and accounts after Microsoft's report.
How 33 Malicious npm Packages Abuse Dependency Confusion to works
On May 28-29, 2026, Microsoft Threat Intelligence identified and reported an active software supply-chain attack targeting the npm registry. A single threat operator, masquerading as three distinct maintainers (mr.4nd3r50n, ce-rwb, t-in-one), published 33 malicious packages spanning nine scoped namespaces engineered to impersonate real internal corporate registries — a textbook dependency-confusion attack. The targeted scopes (@cloudplatform-single-spa, @wb-track, @data-science, @ce-rwb, @payments-widget, @travel-autotests, @t-in-one, @capibar.chat, @sber-ecom-core) heavily mirror Russian technology and financial organizations (Sberbank ecom core, Wildberries tracking, GigaChat ML), and the packages were published with anomalously high version numbers (100.100.100, 99.0.7, 3.5.22) so that a misconfigured client resolving from the public registry pulls the attacker copy over a legitimately scoped internal package.
EXPLOIT/DELIVERY CHAIN: Each package declares a postinstall lifecycle hook (scripts/postinstall.js) that executes automatically the moment a victim runs npm install — no require() from victim code is needed. The ~7KB stager is heavily obfuscated using string-array encoding (URLs, function names, and env keys stored in a rotated array decoded at runtime via a custom Base64 variant), control-flow flattening through computed dispatch tables, and dead-code injection for anti-analysis noise. Execution proceeds through an eight-stage flow: (1) CI/CD detection-and-bypass — the stager checks the CI environment variable or scope-specific kill switches (e.g. CLOUDPLATFORM_SINGLE_SPA_NO_TELEMETRY, T_IN_ONE_NO_TELEMETRY) and silently aborts if set, evading monitored build pipelines; (2) Node.js version validation (>= 16.0); (3) cache-based deduplication — a hash key derived from package name, version, and project-root path is checked against ~/.cache/<scope>_init/, and execution exits if a non-expired marker exists, preventing re-runs that would raise the detection profile; (4) project-root detection by walking the directory tree for package.json, yarn.lock, or .git; (5) platform detection via os.platform(); (6) payload download via HTTPS GET to oob.moika[.]tech/payload/{win|mac|linux} with a 30-second timeout, carrying the hard-coded header X-Secret: l95HdDaz3kQx1Zsg3WxH6HvKANf51RY1; (7) payload drop to os.tmpdir() as a .js file (e.g. ._cloudplatform-single-spa_init.js); (8) detached execution via child process .unref() so the dropped recon payload outlives the npm install process.
RECON DROPPER: The downloaded ~17KB JavaScript dropper performs environment fingerprinting and credential reconnaissance, collecting system information, hostnames, environment variables, and developer context, then exfiltrates over the C2 channel. Behavior is gated by a server-toggleable RECON_ONLY flag passed via the spawned process environment; it is hard-coded to 1 in the current campaign, restricting activity to reconnaissance. The architecture explicitly supports a Full exploitation mode in which the operator flips the flag server-side, converting the established footholds into active exploitation against a pre-built inventory of high-value targets. This two-phase recon-then-exploit design minimizes detection risk during initial deployment while building target intelligence for selective compromise.
INFRASTRUCTURE & ATTRIBUTION: All 33 packages across all three maintainer accounts beacon to the single C2 oob.moika[.]tech, which resolves to 72.56.97.200 on AS210976 (Timeweb, LLP — a CIS-region hosting provider), and every outbound request carries the identical hard-coded X-Secret value l95HdDaz3kQx1Zsg3WxH6HvKANf51RY1. Microsoft assesses a single operator behind all three aliases based on: the shared secret and shared C2 across every account; an identical package-generation template across all accounts indicating one automated generator; matching publishing toolchains (Node.js 20.20.x / npm 10.8.2); and tight publishing-time clustering with a 12-minute account-switch gap and a ~14-hour overnight gap against unchanged infrastructure. The actor uses yandex.ru contact emails (mr.4nd3r50n@yandex[.]ru, ogvanta@yandex[.]ru, t-in-one@yandex[.]ru). The dropper also references fabricated internal lure domains (npm.t-in-one[.]io, docs.t-in-one[.]io, jira.t-in-one[.]io) reinforcing the internal-registry impersonation theme. The mr.4nd3r50n account shows a ~2-year evolution from a bug-bounty researcher persona (@cloudplatform-single-spa/logaas, April 2024) to malware hosting (May 2026).
MITRE ATT&CK techniques used in TL-2026-0633
Collection
Discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1480 Execution Guardrails
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Initial Access
Persistence
T1546 Event Triggered Execution
Credential Access
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
Affected products and versions in 33 Malicious npm Packages Abuse Dependency Confusion to
- npm (OpenJS / GitHub) — npm public registry
Vulnerable versions: registry clients resolving scoped internal packages from the public registry
Fixed in: packages and maintainer accounts removed by npm - Targeted organizations (impersonated scopes) — @cloudplatform-single-spa, @wb-track, @data-science, @ce-rwb, @payments-widget, @travel-autotests, @t-in-one, @capibar.chat, @sber-ecom-core
Vulnerable versions: internal namespaces resolvable from public npm
Remediation for 33 Malicious npm Packages Abuse Dependency Confusion to
Immediate actions
- Block egress to oob.moika[.]tech and 72.56.97.200 at DNS/proxy/firewall
- Hunt for outbound requests carrying header X-Secret: l95HdDaz3kQx1Zsg3WxH6HvKANf51RY1
- Search lockfiles (package-lock.json, yarn.lock) and dependency trees for the 33 affected scoped packages and anomalous versions (100.100.100, 99.0.7, 3.5.22, 99.99.99)
- Audit ~/.cache/ and os.tmpdir() for ._<scope>_init.js files and ._<scope>_init/ marker directories
Workarounds
- Pin known-good package versions and disable automatic upgrades
- Set CI and scope-specific NO_TELEMETRY kill-switch variables only as a stopgap (note: these are attacker-honored bypass flags, not a durable control)
Longer-term hardening
- Configure npm to run installs with --ignore-scripts; gate lifecycle scripts via allowlist
- Enforce scoped-package resolution to the internal registry only (scope-to-registry mapping in .npmrc) to neutralize dependency confusion
- Reserve all internal org scopes on the public npm registry as defensive placeholders
- Deploy EDR/XDR with behavior-based detection of install-time network egress and detached node processes from npm
Weaknesses (CWE) in 33 Malicious npm Packages Abuse Dependency Confusion to
CWE-1357, CWE-829, CWE-506, CWE-494
Timeline of 33 Malicious npm Packages Abuse Dependency Confusion to
- mr.4nd3r50n publishes v0.0.0 of @cloudplatform-single-spa/logaas carrying bug-bounty keywords — earliest footprint of the persona.
- @cloudplatform-single-spa/logaas republished as v99.99.99 with inflated version, foreshadowing the later dependency-confusion versioning.
- Pre-staging of @capibar.chat/ui-kit 99.0.7 and @sber-ecom-core/sberpay-widget 99.0.7 ahead of the main campaign.
- mr.4nd3r50n publishes 26 malicious packages (v100.100.100) at 18:47-18:51 UTC across @cloudplatform-single-spa; ce-rwb publishes 7 packages (v3.5.22) at 19:02-19:03 UTC — a 12-minute account-switch gap.
- As of 2026-05-29, this remains ACTIVE: Microsoft disclosed it just one day prior and npm pulled the 33 packages plus the three aliases, but corroborating vendors (SafeDep/Sonatype) track 164-179 packages across multiple waves with refined TTPs, the oob.moika.tech C2 is not confirmed down, and the server-toggleable RECON_ONLY flag leaves fingerprinted hosts exploitable. Distribution was disrupted yet the single unattributed operator persists and can resurge.
- Threadlinqs verifies oob.moika[.]tech and moika[.]tech resolve to 72.56.97.200 (AS210976, Timeweb LLP); BeaconBeagle returns no known C2-framework config, consistent with a custom JavaScript dropper.
- npm removes the 33 malicious packages and suspends the mr.4nd3r50n, ce-rwb, and t-in-one maintainer accounts.
- Microsoft Threat Intelligence publishes its analysis with full IOCs, attributing all 33 packages to a single operator.
- t-in-one publishes 10 @t-in-one packages at 09:01:56-09:02:39 UTC, and @capibar.chat/@sber-ecom-core packages are republished minutes later — same C2 and X-Secret across all accounts.
Sources cited for 33 Malicious npm Packages Abuse Dependency Confusion to
- Microsoft Security Blog: Malicious npm packages abuse dependency confusion to profile developer environments
- npm maintainer profile (mr.4nd3r50n, 26 packages)
- npm maintainer profile (ce-rwb, 7 packages)
- npm maintainer profile (t-in-one, 12 packages)
- MITRE ATT&CK T1195.002 Compromise Software Supply Chain
- CWE-1357: Reliance on Insufficiently Trustworthy Component
Threats related to 33 Malicious npm Packages Abuse Dependency Confusion to
Detection coverage for TL-2026-0633
As of 2026-05-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0633 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.