# TOPHIT: One-operator npm typosquat flood (@prime0 scope, 85 packages) co-hosted with GPU-cryptojacking C2

> A single npm account (_prime0) published 85 typosquat packages under the @prime0 scope in about three minutes on 15 September 2026, imitating 29 popular libraries such as chalk, semver, debug, minimatch and ajv. Installing a package sends a host fingerprint to a C2 (69.48.229.140:8080) and loading it starts an agent that polls every 30 seconds for a shell command; the same host also runs a VHX Harvester panel targeting the vast.ai GPU marketplace.

- **Published:** 2026-11-13T11:51:31Z
- **Last reviewed:** 2026-11-13T11:51:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5959
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5959.png
- **ID:** TL-2026-5959
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (1 shown free below)

## Description

CloudSEK Adversary Intelligence (TOPHIT Part 1, published 2026-09-29, author Vikas Kundu) documents 85 packages published by the npm account _prime0 under the @prime0 scope between 15:36:25 and 15:39:38 UTC on 15 September 2026. Each package name is a one- or two-character misspelling of one of 29 popular libraries (chalk, semver, debug, minimatch and ajv are named). The generator deletes one of the first three characters of the library name; if the result is already a registered unscoped package it applies another one-character edit such as a neighbouring key (chalk yields dhalk, fhalk and xhalk because calk, chlk and halk are taken). None of the 85 names has an unscoped owner, so a mistyped 'npm install fhalk' returns not-found, but npm search or editor autocomplete can surface @prime0/fhalk first. CloudSEK archived 84 of the 85 packages; only 3 appear in public malicious-package advisories and 82 do not. The scope has since been removed from the registry.

On install, the package sends a fingerprint of the host to 69.48.229.140 on port 8080. Loading the package starts a generic command agent that requests a shell command from the same server every 30 seconds, runs it and returns the output. There is no targeting condition, encryption or authentication. The code is a template whose header comment still contains the unfilled placeholder <PKGNAME>. The report states that nothing in the analysis evidences a successful compromise, no victims are confirmed, no named malware family is assigned, and it is not established whether any developer found the packages through search. Package versions and file hashes are not stated in the public blog.

The same host (69.48.229.140) runs a live GPU-cryptojacking panel on port 80 targeting the vast.ai marketplace, covered in TOPHIT Part 2 (2026-09-29). Part 2 describes a purpose-built offensive panel named VHX Harvester v0.1.0 with an eight-phase process: enumerate GPU hosts via the vast.ai API, scan port ranges, fingerprint services, harvest credentials and metadata, inject stored XSS into vast.ai Caddy auth portals to steal session tokens, rent cheap containers on the same physical host as a target and scan its Docker bridge network (172.17.0.0/16) via bridge agents, reach unprotected Jupyter notebooks for root shells, and finally deploy miners (not yet done as of 2026-09-25). As of 2026-09-25 the panel had enumerated 297 host IPs, scanned 13,368 service endpoints, exfiltrated metadata from 416 services, deployed 25 bridge agents and obtained one confirmed root shell on a victim Jupyter notebook. An unauthenticated endpoint /agent/code.tar.gz serves the full C2 agent source including default credentials; 17 API endpoints lack authentication. CloudSEK links the two services by shared host and, with stated confidence, a shared operator, but does not evidence that the npm agent feeds the GPU operation and says the two hit different victims.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1204.005 Malicious Library
- T1059 Command and Scripting Interpreter
- T1059.007 JavaScript
- T1036.005 Match Legitimate Resource Name or Location
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1071.001 Web Protocols
- T1571 Non-Standard Port
- T1595 Active Scanning
- T1539 Steal Web Session Cookie
- T1610 Deploy Container
- T1190 Exploit Public-Facing Application

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TOPHIT @prime0 npm Typosquat Package Install — Exploitation Phase** (`TL-2026-5959-SPL-001`)

Detects npm/yarn/pnpm/npx command lines that install or run a package from the malicious @prime0 scope (85 typosquats published by npm account _prime0 on 2026-09-15, e.g. @prime0/fhalk, @prime0/dhalk, @prime0/xhalk imitating chalk) or bare chalk-typosquat names. Install triggers a host-fingerprint beacon to 69.48.229.140:8080 and loading starts a 30-second command-polling agent (TL-2026-5959, CWE-506). Scope and names are disposable, so treat this as a fast-triage layer alongside the network and process detections.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1204.005, T1036.005
- **Data sources:** sysmon, microsoft_defender_for_endpoint, process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(CommandLine="*npm*" OR CommandLine="*yarn*" OR CommandLine="*pnpm*" OR CommandLine="*npx*")
(CommandLine="*@prime0*" OR CommandLine="*fhalk*" OR CommandLine="*dhalk*" OR CommandLine="*xhalk*")
| eval matched_ioc=if(match(CommandLine,"@prime0"),"@prime0 scope","chalk typosquat name (fhalk/dhalk/xhalk)")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host, User, matched_ioc
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("npm", "yarn", "pnpm", "npx")
| where ProcessCommandLine contains "@prime0" or ProcessCommandLine has_any ("fhalk", "dhalk", "xhalk")
| extend MatchedIoc = iff(ProcessCommandLine contains "@prime0", "@prime0 scope", "chalk typosquat name")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, MatchedIoc
```

### Sigma

```yaml
title: TOPHIT @prime0 npm Typosquat Package Install
id: 6f1c2a52-8d3e-4b07-9a41-5c7e0d2b9a11
status: experimental
description: Detects package-manager command lines installing or running packages from the malicious @prime0 npm scope or the chalk typosquat names fhalk, dhalk and xhalk (TOPHIT, TL-2026-5959).
references:
    - https://www.cloudsek.com/blog/tophit-npm-typosquat-flood-gpu-cryptojacking-server
    - https://www.cloudsek.com/blog/tophit-part-2-renting-the-attack-surface
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1204.005
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    category: process_creation
detection:
    selection_scope:
        CommandLine|contains: '@prime0'
    selection_pm:
        CommandLine|contains:
            - 'npm'
            - 'yarn'
            - 'pnpm'
            - 'npx'
    selection_names:
        CommandLine|contains:
            - ' fhalk'
            - ' dhalk'
            - ' xhalk'
    condition: selection_scope or (selection_pm and selection_names)
falsepositives:
    - Developers working on an internal package that happens to use the name fhalk, dhalk or xhalk
    - Security teams reproducing the CloudSEK analysis in a sandbox
level: high

```

**Known false positives:**

- Security researchers or red teams deliberately installing @prime0 samples in an isolated lab
- Internal packages whose names coincide with fhalk, dhalk or xhalk

**Tuning notes:** Restrict to developer workstations and CI runners; allow-list sandbox hosts used for malware analysis. Extend the name list with further @prime0 typosquats as published by CloudSEK; the scope was removed from the registry so also hunt historical lockfiles. Sysmon for Linux uses a different sourcetype; adjust index/sourcetype for Linux build runners.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TOPHIT Node.js Agent Spawning Shell With Host Recon — Post-Exploitation (locked: unlock with TL Creds)
- TOPHIT Process Command Line Referencing C2 [indicator] or [indicator] — Post-Exploitation (locked: unlock with TL Creds)
- TOPHIT Container Scanning Docker Bridge [indicator] — Post-Exploitation (locked: unlock with TL Creds)
- TOPHIT Firewall Traffic to C2 [indicator] With 30-Second Beacon Cadence — C2 (locked: unlock with TL Creds)
- TOPHIT Node.js Process Connecting to C2 [indicator]:8080 — C2 (locked: unlock with TL Creds)
- TOPHIT Proxy Request for /agent/[indicator] on [indicator] — C2 (locked: unlock with TL Creds)
- TOPHIT [indicator] Package Files Written to node_modules — Exploitation Phase (locked: unlock with TL Creds)
- TOPHIT Node.js Executing Code From node_modules/[indicator] — Exploitation Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 13)

Defanged, TLP:CLEAR.

- IP address: `69.48.229[.]140`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [TOPHIT Part 1: A one-operator npm typosquat flood, co-hosted with a GPU-cryptojacking C2](https://www.cloudsek.com/blog/tophit-npm-typosquat-flood-gpu-cryptojacking-server)
- [TOPHIT Part 1 full report (PDF)](https://cdn.cloudsek.com/cloudsek-blog-pdfs/tophit-part-8ysx.pdf)
- [TOPHIT Part 2: Renting the Attack Surface (VHX Harvester, vast.ai)](https://www.cloudsek.com/blog/tophit-part-2-renting-the-attack-surface)
- [TOPHIT Part 2 full report (PDF)](https://cdn.cloudsek.com/cloudsek-blog-pdfs/tophit-part-yisx.pdf)
- [CloudSEK Adversary Intelligence author page (Vikas Kundu)](https://www.cloudsek.com/authors/vikas-kundu)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5959