Cybersecurity Startup Publishes Infostealers to NPM

What it is

Seven npm packages (five AI-SDK typosquats plus @aspect-security/argon2 and argon2-napi), published June 2026 by a single account, that behave as infostealers via install scripts. Specific latest versions analyzed: anthropic-toolkit@1.3.0, ai-sdk-helpers@1.4.4, ollama-helpers@1.2.2, openai-agents-helpers@1.3.2, @langgraphjs/toolkit@1.2.12, @aspect-security/argon2@1.0.1, argon2-napi@1.0.0. The argon2 packages date to April 2026 — the same operator's earlier iteration.

How it works

The payload runs from a postinstall script, not the library code:

"scripts": { "postinstall": "node scripts/postinstall.js" }

npm executes this automatically, silently, with the installer's permissions — before any of your code imports the package. On a laptop that's your dotfiles; on a CI runner it's the build account with cloud creds and deploy keys.

The evasion turn is deliberate file separation. Each package ships a genuine, working, non-booby-trapped src/ of TypeScript helpers (retry.ts, stream-to-string.ts, etc.) and a polished README — none of it malicious, none of it ever called. The real payload is scripts/postinstall.js: 461 lines / 16 KB of hand-written, non-obfuscated JavaScript. Auditing the source you'd normally read does not catch this, because that source is not what runs on install.

The script opens with a comment block posing as a telemetry policy, itemizing "anonymous diagnostics" and offering an opt-out env var (ANTHROPIC_TOOLKIT_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1) set before install. The opt-out genuinely works — it exists to hand security-conscious devs a lever while everyone else gets profiled. It harvests 11 data categories into one JSON object and POSTs it over HTTPS in a single beacon. Categories confirmed by the text: machine identity (hostname, OS username, Windows DOMAIN\USER) and git identity (text cut off mid-list); summary adds git/SSH keys and cloud credentials.

Preconditions / Affected

Anyone who ran npm install on these package names, on a dev machine or CI runner. Every install fires the beacon at least once, so the ~20k downloads are a floor on machines profiled. Highest-exposure packages by last-month downloads: ai-sdk-helpers (7,930), @langgraphjs/toolkit (5,877), openai-agents-helpers (3,108), ollama-helpers (2,692).

What to do

• Search build logs and lockfiles for the seven names above; treat any install as a credential-exposure event — rotate git/SSH keys and cloud credentials on affected hosts and CI accounts.
• Do not rely on reviewing src/ — inspect package.json preinstall/postinstall fields and the referenced script files for anything the audited source doesn't call.
• Consider --ignore-scripts for installs where native builds aren't required.

Caveats

No RAT or persistence — these are pure exfiltration beacons, not backdoors. The 11-category list is truncated in the fetched text (identity categories shown; the rest inferred only from the existing summary). Attribution to an Israeli cybersecurity-startup founder is the researchers' claim, not independently confirmed here.