TOPHIT: One-operator npm typosquat flood (@prime0 scope, 85 packages) co-hosted with GPU-cryptojacking C2

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5959 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TOPHIT @prime0 npm Typosquat Package Install — Exploitation Phase

Detects npm/yarn/pnpm/npx command lines that install or run a package from the malicious @prime0 scope (85 typosquats published by npm account _prime0 on 2026-09-15, e.g. @prime0/fhalk, @prime0/dhalk, @prime0/xhalk imitating chalk) or bare chalk-typosquat names. Install triggers a host-fingerprint beacon to 69.48.229.140:8080 and loading starts a 30-second command-polling agent (TL-2026-5959, CWE-506). Scope and names are disposable, so treat this as a fast-triage layer alongside the network and process detections.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1204.005, T1036.005
• Data sources: sysmon, microsoft_defender_for_endpoint, process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(CommandLine="*npm*" OR CommandLine="*yarn*" OR CommandLine="*pnpm*" OR CommandLine="*npx*")
(CommandLine="*@prime0*" OR CommandLine="*fhalk*" OR CommandLine="*dhalk*" OR CommandLine="*xhalk*")
| eval matched_ioc=if(match(CommandLine,"@prime0"),"@prime0 scope","chalk typosquat name (fhalk/dhalk/xhalk)")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host, User, matched_ioc
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("npm", "yarn", "pnpm", "npx")
| where ProcessCommandLine contains "@prime0" or ProcessCommandLine has_any ("fhalk", "dhalk", "xhalk")
| extend MatchedIoc = iff(ProcessCommandLine contains "@prime0", "@prime0 scope", "chalk typosquat name")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, MatchedIoc

Sigma

title: TOPHIT @prime0 npm Typosquat Package Install
id: 6f1c2a52-8d3e-4b07-9a41-5c7e0d2b9a11
status: experimental
description: Detects package-manager command lines installing or running packages from the malicious @prime0 npm scope or the chalk typosquat names fhalk, dhalk and xhalk (TOPHIT, TL-2026-5959).
references:
    - https://www.cloudsek.com/blog/tophit-npm-typosquat-flood-gpu-cryptojacking-server
    - https://www.cloudsek.com/blog/tophit-part-2-renting-the-attack-surface
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1204.005
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    category: process_creation
detection:
    selection_scope:
        CommandLine|contains: '@prime0'
    selection_pm:
        CommandLine|contains:
            - 'npm'
            - 'yarn'
            - 'pnpm'
            - 'npx'
    selection_names:
        CommandLine|contains:
            - ' fhalk'
            - ' dhalk'
            - ' xhalk'
    condition: selection_scope or (selection_pm and selection_names)
falsepositives:
    - Developers working on an internal package that happens to use the name fhalk, dhalk or xhalk
    - Security teams reproducing the CloudSEK analysis in a sandbox
level: high

Known false positives:

• Security researchers or red teams deliberately installing @prime0 samples in an isolated lab
• Internal packages whose names coincide with fhalk, dhalk or xhalk

Tuning notes: Restrict to developer workstations and CI runners; allow-list sandbox hosts used for malware analysis. Extend the name list with further @prime0 typosquats as published by CloudSEK; the scope was removed from the registry so also hunt historical lockfiles. Sysmon for Linux uses a different sourcetype; adjust index/sourcetype for Linux build runners.

• 🔒 TOPHIT Node.js Agent Spawning Shell With Host Recon — Post-Exploitation · unlock with TL Creds
• 🔒 TOPHIT Process Command Line Referencing C2 [indicator] or [indicator] — Post-Exploitation · unlock with TL Creds
• 🔒 TOPHIT Container Scanning Docker Bridge [indicator] — Post-Exploitation · unlock with TL Creds
• 🔒 TOPHIT Firewall Traffic to C2 [indicator] With 30-Second Beacon Cadence — C2 · unlock with TL Creds
• 🔒 TOPHIT Node.js Process Connecting to C2 [indicator]:8080 — C2 · unlock with TL Creds
• 🔒 TOPHIT Proxy Request for /agent/[indicator] on [indicator] — C2 · unlock with TL Creds
• 🔒 TOPHIT [indicator] Package Files Written to node_modules — Exploitation Phase · unlock with TL Creds
• 🔒 TOPHIT Node.js Executing Code From node_modules/[indicator] — Exploitation Phase · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5959.

Sample indicators (1 of 13)

• IP address: 69.48.229[.]140

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

Technical analysis

CloudSEK Adversary Intelligence (TOPHIT Part 1, published 2026-09-29, author Vikas Kundu) documents 85 packages published by the npm account _prime0 under the @prime0 scope between 15:36:25 and 15:39:38 UTC on 15 September 2026. Each package name is a one- or two-character misspelling of one of 29 popular libraries (chalk, semver, debug, minimatch and ajv are named). The generator deletes one of the first three characters of the library name; if the result is already a registered unscoped package it applies another one-character edit such as a neighbouring key (chalk yields dhalk, fhalk and xhalk because calk, chlk and halk are taken). None of the 85 names has an unscoped owner, so a mistyped 'npm install fhalk' returns not-found, but npm search or editor autocomplete can surface @prime0/fhalk first. CloudSEK archived 84 of the 85 packages; only 3 appear in public malicious-package advisories and 82 do not. The scope has since been removed from the registry.

On install, the package sends a fingerprint of the host to 69.48.229.140 on port 8080. Loading the package starts a generic command agent that requests a shell command from the same server every 30 seconds, runs it and returns the output. There is no targeting condition, encryption or authentication. The code is a template whose header comment still contains the unfilled placeholder <PKGNAME>. The report states that nothing in the analysis evidences a successful compromise, no victims are confirmed, no named malware family is assigned, and it is not established whether any developer found the packages through search. Package versions and file hashes are not stated in the public blog.

The same host (69.48.229.140) runs a live GPU-cryptojacking panel on port 80 targeting the vast.ai marketplace, covered in TOPHIT Part 2 (2026-09-29). Part 2 describes a purpose-built offensive panel named VHX Harvester v0.1.0 with an eight-phase process: enumerate GPU hosts via the vast.ai API, scan port ranges, fingerprint services, harvest credentials and metadata, inject stored XSS into vast.ai Caddy auth portals to steal session tokens, rent cheap containers on the same physical host as a target and scan its Docker bridge network (172.17.0.0/16) via bridge agents, reach unprotected Jupyter notebooks for root shells, and finally deploy miners (not yet done as of 2026-09-25). As of 2026-09-25 the panel had enumerated 297 host IPs, scanned 13,368 service endpoints, exfiltrated metadata from 416 services, deployed 25 bridge agents and obtained one confirmed root shell on a victim Jupyter notebook. An unauthenticated endpoint /agent/code.tar.gz serves the full C2 agent source including default credentials; 17 API endpoints lack authentication. CloudSEK links the two services by shared host and, with stated confidence, a shared operator, but does not evidence that the npm agent feeds the GPU operation and says the two hit different victims.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter; T1059.007 JavaScript; T1204.005 Malicious Library; T1610 Deploy Container

Command and Control

T1071.001 Web Protocols; T1571 Non-Standard Port

Initial Access

T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain

Credential Access

T1539 Steal Web Session Cookie

Reconnaissance

T1595 Active Scanning

Remediation

Immediate actions

• Block 69.48.229.140 (ports 8080 and 80) at egress
• Search dependency manifests and lockfiles for references to @prime0
• Treat a machine that installed one @prime0 package as having disclosed its host details
• Treat a machine or build runner that loaded one as having run an operator-controlled command channel for as long as the program ran; rotate secrets reachable from it

Workarounds

• vast.ai defenders: audit Caddy auth proxy configuration for the bypass that enabled the root shell
• Monitor for containers scanning the Docker bridge range 172.17.0.0/16
• Report the operator infrastructure to the hosting provider

Longer-term hardening

• Detect on shipped code and the network sequence (install-time fingerprint beacon, 30-second command polling) rather than package names, since names are generated and disposable
• Alert on any process or container downloading code from 69.48.229.140
• Review npm install practices: verify package scope and publisher before adding dependencies surfaced by search or editor autocomplete

Affected and fixed versions

• npm (registry ecosystem) — Node.js projects and build runners installing @prime0/* typosquat packages
  Vulnerable versions: @prime0/* (85 packages; versions not stated in source)
• vast.ai — GPU rental marketplace hosts and renters targeted by VHX Harvester
  Vulnerable versions: Not stated in source

Timeline

• 2026-09-15 85th @prime0 package published at 15:39:38 UTC, about three minutes after the first, imitating 29 popular libraries.
• 2026-09-15 npm account _prime0 begins publishing @prime0 scoped typosquat packages at 15:36:25 UTC.
• 2026-09-25 VHX Harvester panel on locked-ioc-4 had enumerated 297 vast.ai host IPs from the public API, scanned 13,368 service endpoints and exfiltrated metadata from 416 services; activity log shows continuous rent attempts.
• 2026-09-25 As of this snapshot the VHX Harvester panel had obtained one confirmed root shell on a victim vast.ai Jupyter notebook and deployed 25 bridge agents; no cryptominers had yet been planted.
• 2026-09-29 CloudSEK publishes TOPHIT Part 2 (Renting the Attack Surface) documenting the VHX Harvester GPU-hijacking panel co-hosted on the same server.
• 2026-09-29 CloudSEK publishes TOPHIT Part 1 documenting the @prime0 npm typosquat flood and the locked-ioc-4:8080 command agent C2.

Sources cited

• TOPHIT Part 1 full report (PDF) cdn.cloudsek.com · Research · 2026-09-29
• TOPHIT Part 2 full report (PDF) cdn.cloudsek.com · Research · 2026-09-29
• CloudSEK Adversary Intelligence author page (Vikas Kundu) cloudsek.com · Research · 2026-09-29
• TOPHIT Part 1: A one-operator npm typosquat flood, co-hosted with a GPU-cryptojacking C2 cloudsek.com · Blog · 2026-09-29
• TOPHIT Part 2: Renting the Attack Surface (VHX Harvester, vast.ai) cloudsek.com · Blog · 2026-09-29

More in supply chain

• Cursor Supply-Chain Compromise: Leaked Fireworks AI Key Leads to Backdoored Anthropic.claude-code Extension (2.1.312/2.1.313) in Cursor Marketplace Cache
• nDiligence 'Attack the Glass' (ATG): Runtime Client-Side Rendering Supply-Chain Vulnerability Class Across 50 Platform Types
• Binance Hack: Tampered Homebrew Package Delivers macOS Stealer; Infostealers and AI-Powered Profiling Feed Social Engineering (TraderTraitor attribution)
• wfx-loot: GitHub Actions CI secret stealer pushed to public repositories using stolen GitHub credentials
• Quantum Systems QBase ground-control software update reportedly malware-laden; Bundeswehr drones grounded as precaution

Previous and next in supply chain

• Supply Chain Compromise Trends 2025-2026: TeamPCP (UNC6780) package poisoning, axios npm compromise (MIDNIGHT NEPTUNE / UNC1069), and mitigation guidance Previous report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages