# 33 Malicious npm Packages Abuse Dependency Confusion to Profile Developer Environments (oob.moika[.]tech C2)

> Microsoft Threat Intelligence uncovered an active npm supply-chain campaign in which a single operator using three maintainer aliases (mr.4nd3r50n, ce-rwb, t-in-one) published 33 malicious packages on May 28-29, 2026 across nine organizational scopes that mirror real internal corporate namespaces, exploiting dependency confusion. Every package ships an identical obfuscated postinstall stager that fetches a ~17KB platform-specific JavaScript reconnaissance dropper from C2 oob.moika[.]tech (72.56.97.200, Timeweb AS210976), fingerprinting developer environments and harvesting credentials and context. A server-toggleable RECON_ONLY flag, hard-coded to 1, stages the operation for selective follow-on full exploitation. npm removed the packages and accounts after Microsoft's report.

- **Published:** 2026-05-29T00:00:00Z
- **Last reviewed:** 2026-05-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0633
- **ID:** TL-2026-0633
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On May 28-29, 2026, Microsoft Threat Intelligence identified and reported an active software supply-chain attack targeting the npm registry. A single threat operator, masquerading as three distinct maintainers (mr.4nd3r50n, ce-rwb, t-in-one), published 33 malicious packages spanning nine scoped namespaces engineered to impersonate real internal corporate registries — a textbook dependency-confusion attack. The targeted scopes (@cloudplatform-single-spa, @wb-track, @data-science, @ce-rwb, @payments-widget, @travel-autotests, @t-in-one, @capibar.chat, @sber-ecom-core) heavily mirror Russian technology and financial organizations (Sberbank ecom core, Wildberries tracking, GigaChat ML), and the packages were published with anomalously high version numbers (100.100.100, 99.0.7, 3.5.22) so that a misconfigured client resolving from the public registry pulls the attacker copy over a legitimately scoped internal package.

EXPLOIT/DELIVERY CHAIN: Each package declares a postinstall lifecycle hook (scripts/postinstall.js) that executes automatically the moment a victim runs npm install — no require() from victim code is needed. The ~7KB stager is heavily obfuscated using string-array encoding (URLs, function names, and env keys stored in a rotated array decoded at runtime via a custom Base64 variant), control-flow flattening through computed dispatch tables, and dead-code injection for anti-analysis noise. Execution proceeds through an eight-stage flow: (1) CI/CD detection-and-bypass — the stager checks the CI environment variable or scope-specific kill switches (e.g. CLOUDPLATFORM_SINGLE_SPA_NO_TELEMETRY, T_IN_ONE_NO_TELEMETRY) and silently aborts if set, evading monitored build pipelines; (2) Node.js version validation (>= 16.0); (3) cache-based deduplication — a hash key derived from package name, version, and project-root path is checked against ~/.cache/<scope>_init/, and execution exits if a non-expired marker exists, preventing re-runs that would raise the detection profile; (4) project-root detection by walking the directory tree for package.json, yarn.lock, or .git; (5) platform detection via os.platform(); (6) payload download via HTTPS GET to oob.moika[.]tech/payload/{win|mac|linux} with a 30-second timeout, carrying the hard-coded header X-Secret: l95HdDaz3kQx1Zsg3WxH6HvKANf51RY1; (7) payload drop to os.tmpdir() as a .js file (e.g. ._cloudplatform-single-spa_init.js); (8) detached execution via child process .unref() so the dropped recon payload outlives the npm install process.

RECON DROPPER: The downloaded ~17KB JavaScript dropper performs environment fingerprinting and credential reconnaissance, collecting system information, hostnames, environment variables, and developer context, then exfiltrates over the C2 channel. Behavior is gated by a server-toggleable RECON_ONLY flag passed via the spawned process environment; it is hard-coded to 1 in the current campaign, restricting activity to reconnaissance. The architecture explicitly supports a Full exploitation mode in which the operator flips the flag server-side, converting the established footholds into active exploitation against a pre-built inventory of high-value targets. This two-phase recon-then-exploit design minimizes detection risk during initial deployment while building target intelligence for selective compromise.

INFRASTRUCTURE & ATTRIBUTION: All 33 packages across all three maintainer accounts beacon to the single C2 oob.moika[.]tech, which resolves to 72.56.97.200 on AS210976 (Timeweb, LLP — a CIS-region hosting provider), and every outbound request carries the identical hard-coded X-Secret value l95HdDaz3kQx1Zsg3WxH6HvKANf51RY1. Microsoft assesses a single operator behind all three aliases based on: the shared secret and shared C2 across every account; an identical package-generation template across all accounts indicating one automated generator; matching publishing toolchains (Node.js 20.20.x / npm 10.8.2); and tight publishing-time clustering with a 12-minute account-switch gap and a ~14-hour overnight gap against unchanged infrastructure. The actor uses yandex.ru contact emails (mr.4nd3r50n@yandex[.]ru, ogvanta@yandex[.]ru, t-in-one@yandex[.]ru). The dropper also references fabricated internal lure domains (npm.t-in-one[.]io, docs.t-in-one[.]io, jira.t-in-one[.]io) reinforcing the internal-registry impersonation theme. The mr.4nd3r50n account shows a ~2-year evolution from a bug-bounty researcher persona (@cloudplatform-single-spa/logaas, April 2024) to malware hosting (May 2026).

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1608 Stage Capabilities
- T1587 Develop Capabilities
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1546 Event Triggered Execution
- T1027 Obfuscated Files or Information
- T1480 Execution Guardrails
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1016 System Network Configuration Discovery
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Microsoft Security Blog: Malicious npm packages abuse dependency confusion to profile developer environments](https://www.microsoft.com/en-us/security/blog/2026/05/29/33-malicious-npm-packages-abuse-dependency-confusion-profile-developer-environments/)
- [npm maintainer profile (mr.4nd3r50n, 26 packages)](https://www.npmjs.com/~mr.4nd3r50n)
- [npm maintainer profile (ce-rwb, 7 packages)](https://www.npmjs.com/~ce-rwb)
- [npm maintainer profile (t-in-one, 12 packages)](https://www.npmjs.com/~t-in-one)
- [MITRE ATT&CK T1195.002 Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
- [CWE-1357: Reliance on Insufficiently Trustworthy Component](https://cwe.mitre.org/data/definitions/1357.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0633