"Download Pumping" — npm Supply-Chain Trust-Signal Abuse via Mass Version Uploads (ambar-src / reverse_ssh / Apfell) — Threadlinqs Intelligence
As of 2026-07-18, "Download Pumping" — npm Supply-Chain Trust-Signal Abuse via Mass Version Uploads (ambar-src / reverse_ssh / Apfell) is a high-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-1491 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Tenable researcher Ron Popov documented 'download pumping', a supply-chain deception technique in which attackers publish hundreds of package versions in rapid succession so that registry mirrors,
In mid-February 2026 Tenable Research identified a malicious npm package, 'ambar-src', that typosquatted the popular 'ember-source' package (11M+ downloads). The package was first uploaded on 2026-02-13 and published as a series of benign-looking versions — 428 of them in the first two hours alone, eventually reaching 724 total versions — before a weaponized version was pushed on 2026-02-16 at 12:18:45 UTC. npm removed the package roughly 4h44m later (17:02:44 UTC the same day), but by then it had accumulated approximately 50,000 downloads with zero legitimate human users.
The malicious version abused npm's `preinstall` lifecycle script hook defined in package.json: merely running `npm install ambar-src`, or having it resolve transitively as a dependency, was sufficient to trigger the payload with no explicit `require()`/import needed. The `index.js` preinstall script executed a hex-encoded, OS-specific one-liner to obscure intent, and the package interspersed legitimate-looking utility code (MathUtils, StringUtils, time helpers) with the malicious logic to evade cursory review.
Platform-specific second-stage payloads were fetched from the attacker-controlled domain x-ya[.]ru: on Windows, an encrypted-shellcode loader (msinit.exe, ~400KB) decoded and executed the shellcode in memory; on Linux, a bash script pulled an ELF binary ('osa') identified via Golang build metadata as a variant of the open-source reverse_ssh backdoor; on macOS, a nohup-wrapped hex command invoked the native `osascript` utility to run a ~500KB JavaScript payload identified as Apfell, part of the MythicAgents C2 framework family, capable of reconnaissance, screenshot capture, Google Chrome credential/session data theft, and fake password-prompt phishing overlays. Command-and-control communications were relayed through Yandex Cloud Functions (function.yandexcloud[.]ru / functions.yandexcloud.net), abusing a well-known cloud service to blend in with legitimate traffic (MITRE T1102 Web Service).
Separately, and more broadly, Tenable's Ron Popov demonstrated the underlying 'download pumping' abuse pattern with proof-of-concept test packages: every new version publish triggers automated downloads from registry mirrors and security-scanner/analysis-bot infrastructure — 135.55 downloads/version for a plain version bump, 141.91 for a static postinstall script, and 158.16 for a dynamically-changing postinstall script, implying scanners preferentially re-fetch versions that look newly suspicious. Because scanners can often determine whether a postinstall script exists purely from package metadata (without downloading the tarball), attackers can game detection infrastructure itself into serving as an amplification network. Tenable also revalidated a 2021-era technique of direct tarball-URL HTTP request flooding, inflating a test package to 17,000 downloads in about one hour — showing the older method still works alongside the newer one. ReversingLabs' write-up (crediting Popov) and Tenable's own technical FAQ both note the underlying registry infrastructure pattern is not npm-specific: PyPI, RubyGems, and NuGet operate comparable automated-mirror/scanner ecosystems and are described as similarly exposed.
The attack is notable for its convergence with AI-assisted coding tools, which frequently use download counts, version-history density, and maintenance-activity signals as heuristics for package trustworthiness/recommendation — none of which were designed as security controls and all of which download pumping can fabricate cheaply. Recommended mitigations center on enforcing minimum package-age windows (3-4+ days) before a newly published version is eligible for use in CI/CD or production, alongside version pinning, least-privilege network egress for build/CI environments, ephemeral just-in-time credentials in place of long-lived tokens, and stronger maintainer/publish authentication. Dissenting industry voices (James Shank, Expel; John Strand, BHIS) argued mini
Weaknesses (CWE)
CWE-506, CWE-1357, CWE-829
Target sectors: technology, software-development, government administration, finance, health
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1584, T1585, T1587, T1195, T1059, T1204, T1546, T1505, T1027, T1140