opensourcemalware.comwriteupWindows Infostealer Hits npm and Ruby
Follow-up analysis showing that the RubyGems StubMaker typosquatting campaign and a separately-discovered 40-package npm typosquatting campaign (targeting chalk, commander, lodash, typescript, react, axios) are run by the same threat actor: both use install-time hooks (extconf.rb vs postinstall.js) to fetch a Rust loader from the same GitHub release, which decrypts a byte-for-byte identical Go infostealer confirmed by matching SHA-256 hashes. The stealer harvests browser credentials (bypassing Chromium app-bound encryption), crypto wallets/seed phrases, and Telegram data, exfiltrating via Gofile to a webhook at dresslee.com, and includes WSL-to-Windows sandbox escape logic. The post publishes full network/file IOCs and hashes and argues network-layer blocking (C2 IP and webhook domain) is more durable than package-name blocklisting.
What it is
A cross-ecosystem infostealer operation that OpenSourceMalware links to the previously reported RubyGems StubMaker campaign. The npm side is a 40-package typosquat burst (37 documented by OpenHack, plus three the author adds: typecript-cli, typecript-core, typescrit-cli). The tie is not behavioral similarity but byte-for-byte identical payloads — same Rust loader and embedded Go infostealer by SHA-256 across both ecosystems.
How it works
Both ecosystems use a fake native-extension install hook. On install, the package pulls a ~22 MB Rust loader that decrypts an embedded Go infostealer entirely in memory — no second-stage download. The loader is fetched from a GitHub release, both installers beacon to the same C2, and stolen data is uploaded to Gofile with the resulting link reported to an attacker webhook.
Preconditions / Affected
Windows developer hosts that installed any of the typosquats of chalk, commander, lodash, typescript, react, axios (npm) or bundler, i18n, rake, activesupport (RubyGems). The npm packages were live only in an eight-minute window from ~02:48 UTC on August 16, fully taken down by 04:12 UTC — but any install during that window is compromised. Impact per the page: browser credentials, authenticated browser sessions, payment-card data, crypto wallets and seed phrases, Telegram data, and host info.
What to do
Block / hunt for these IOCs (the page's concrete additions beyond the summary):
- C2 beacon:
193.70.34.101:20099/vote - Loader source:
github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe - Exfil webhook:
dresslee.com(over unencrypted HTTP) - npm publisher accounts (all burner Gmail):
verifikasikkiunila555a,whatisthisapplive20238261,fullbasketpropertywebsiteb53a,nodemailert451e6,antoniorodriguezmonte84ddf8 - RubyGems accounts:
gemlewqqhu1,mod8rz41mje,rbq95bwt6q
Note the operator's persistence: on RubyGems the package brumdler was taken down once and successfully republished under a second owner — a single takedown is not the end of it.
Caveats
The npm package name column in the recovered table is largely truncated/unlabeled after takedown, so per-package names are incomplete; matching is best done on the accounts, C2, and GitHub release URL rather than exact package strings. The dresslee.com webhook is confirmed on the RubyGems side; the npm exfil is asserted as the same infrastructure via identical payload hashes.
Organisations named here
- dresslee.com
Technologies named here
- Gofile
- RubyGems
- GitHub Releases
- npm
- Windows
- Chromium
- WSL
- Rust
- Go
- Telegram
- OpenHack
Techniques named here
- Typosquatting
- Malicious install-time lifecycle hook
- Obfuscation via encoding
- In-memory payload execution
- Unsigned detached process spawning
- Sandbox escape via WSL bridging
- Browser credential/app-bound encryption bypass
- C2 beaconing
- Exfiltration via cloud file-sharing plus webhook
- Parallel burner-account distribution
- Catch-and-adapt republishing
Threat actors named here
- StubMaker
Related in Supply Chain
