# BRIDGEHEAD: npm typosquatting campaign crosses from WSL into Windows to deploy Rust crypto-wallet stealer

> CloudSEK reports 40 typosquatted npm packages (v1.0.0) imitating chalk, axios, commander, lodash, react and typescript, published and unpublished on 2026-08-16. Install hooks detect Windows/WSL, bridge into the Windows host via hidden PowerShell, and run an in-memory Rust stealer (main.exe) that targets cryptocurrency wallets, Chromium browser data and Telegram sessions, uploading to gofile.io. The operator C2 at 193.70.34.101:20099 was still answering at time of analysis.

- **Published:** 2026-10-14T22:16:35Z
- **Last reviewed:** 2026-10-14T22:16:35Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3557
- **ID:** TL-2026-3557
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In August 2026 an operator published 40 disposable npm packages, each a misspelling of a heavily installed library: chalk (4 packages), axios (2), commander (9), lodash (7), react (1) and typescript (16), plus one test package (testingsmthb1g). All were version 1.0.0 and carried a scripts/postinstall.js install hook. Per CloudSEK the packages were published 2026-08-16 between 02:28 and 02:56 UTC and unpublished between 04:07 and 04:12 UTC, about 84 minutes of exposure. They were spread across five throwaway npm accounts with generated names.

The install hook holds XOR-encoded arrays (key 'stf2026'; array names ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) that decode to the payload URL, the PowerShell bridge commands and the download logic. It first sends an install beacon to the C2 (POST http://193.70.34.101:20099/vote) carrying only a coarse OS label (Windows, MacOS or Linux). It then runs a WSL gate: the WSL_DISTRO_NAME and WSLENV environment variables, and /proc/version and /proc/sys/kernel/osrelease checked for 'microsoft' or 'WSL' (function isVirtualizedLinux). Only Windows and WSL hosts get the payload. From WSL it calls powershell.exe -WindowStyle Hidden -NoProfile -NonInteractive -ExecutionPolicy Bypass to run Invoke-WebRequest into $env:TEMP\main.exe followed by a hidden Start-Process. On native Windows, Node's HTTPS client downloads main.exe to %TEMP% and spawns it detached with no shell.

The payload is a release asset on GitHub, not in npm: https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe. The bebraz1 account was created 2026-06-20 and its name and bio were literally 'null'. The release was published 2026-08-15 and downloads rose from 119 to 173 between 2026-08-17 01:50 and 18:49 UTC. GitHub removed the account by 2026-08-17 23:12 UTC. The payload therefore survived the npm takedown by roughly 39 hours.

main.exe is a 22,969,344-byte Rust-compiled PE32+ GUI executable with a zeroed PE timestamp. About 98.7% of it is .rdata, which holds a single run of about 22.6 million hex characters. That run decodes to an 11,319,296-byte (0xACB800) encrypted blob. The wrapper decrypts it with a ChaCha20 variant whose constant is deliberately mutated ('expad 232-byte k' instead of 'expand 32-byte k'), then runs it in-process with no disk write and no child process. It has a timing-based anti-analysis loop of 552,054 iterations that sleeps 500 ms if it finishes in 9 ms or less. Embedded strings include 'ez_run_', '.exe', '.exe.config' and the log string '[LOG] Payload unpacking and decryption completed in'.

The decrypted stealer imports DPAPI and crypto libraries (crypt32, dpapi, cryptbase, bcryptprimitives) and uses raw Winsock sockets. It resolves api.ipify.org to fingerprint the victim's public IP, then about 0.18 s later contacts upload.gofile.io, an anonymous public file host, to upload stolen data. CloudSEK's sandbox saw TLS certificate validation reject both connections, so no exfiltration was observed. It also collects CPU, GPU and RAM telemetry. Targets are 26 desktop wallet paths (Electrum-DASH, Electron Cash, ElectrumSV, Exodus, Copay/BitPay, Specter, OneKey, KeepKey, SafePal, Trezor Suite, Wasabi, Jaxx Liberty, Coinbase Wallet, Infinity Wallet, Daedalus, Blockstream Green, Bybit and others), Microsoft Edge and Brave profile data (Local State, Web Data, History, Cookies), and Telegram Desktop tdata directories. The run lasts about 33 seconds and the process then exits with no persistence.

The source gives no attribution; the cryptocurrency focus suggests a financial motive. Severity HIGH is an analyst assessment: no CVE or CVSS exists, the payload steals wallet and credential material from developer hosts, and the C2 was live.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.002 Compromise Software Supply Chain
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1497.001 System Checks
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1620 Reflective Code Loading
- T1082 System Information Discovery
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1567.002 Exfiltration to Cloud Storage

## Sources

- [BRIDGEHEAD: An npm typosquatting campaign that crosses from WSL into Windows to plant a crypto-wallet stealer (CloudSEK, Vikas Kundu)](https://www.cloudsek.com/blog/bridgehead-npm-typosquatting-wsl-windows-crypto-wallet-stealer)
- [40 fake npm packages: WSL was the real target (OffSeq Threat Radar)](https://radar.offseq.com/threat/40-fake-npm-packages-wsl-was-the-real-target-2bfc80e037765393)
- [BRIDGEHEAD: npm Typosquatting Campaign Targeting WSL and Windows (detections.ai)](https://detections.ai/intel-exchange/01a03435-27ce-7579-8635-43d7d2061e53)
- [BRIDGEHEAD summary (Hendry Adrian)](https://www.hendryadrian.com/bridgehead-an-npm-typosquatting-campaign-that-crosses-from-wsl-into-windows-to-plant-a-crypto-wallet-stealer-cloudsek/)
- [MITRE ATT&CK T1195.002 Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
- [MITRE ATT&CK T1620 Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)
- [MITRE ATT&CK T1497.001 Virtualization/Sandbox Evasion: System Checks](https://attack.mitre.org/techniques/T1497/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3557