MAL-2026-10704

Dashboard / Malicious Package / MAL-2026-10704

MAL-2026-10704

Summary: Malicious code in @across-toolkit/typescript-config (npm)

Details: The npm package `@across-toolkit/typescript-config` is a dependency-confusion credential stealer targeting developers of Across Protocol (across.to). It masquerades as an internal ESLint/TypeScript config for the `across.to` toolkit and publishes an implausibly high version (`99.0.0`) so that a misconfigured install resolves it from the public npm registry instead of a private package of the same name — the standard dependency-confusion technique. A `postinstall` lifecycle hook (`postinstall: node postinstall.js`) executes automatically on `npm install`, before the package is ever imported. Using `os.homedir()`, the payload reads the host's AWS credentials (`~/.aws/credentials`), SSH private key (`~/.ssh/id_rsa`) and npm token (`~/.npmrc`), collects `process.env`, and exfiltrates the data via an HTTP `POST` to a hardcoded `webhook.site` endpoint (`https://webhook.site/a585f4ec-20f7-4bd1-bac7-f3e53799dc5f`). The payload is present in both the root `postinstall.js` and a nested `eslint-config/postinstall.js`, and uses `child_process`. Any developer workstation or CI runner that installs the package hands the operator AWS credentials, an SSH private key and an npm publish token. Detected and classified independently by codelake Research from the live npm feed on 2026-07-16; at the time of reporting the package was not present in OSV or GHSA (verified live) — a first-catch. Source: amazon-inspector (5580d26d1829c9faf6465962431399aee9804c8ed1264274b30b9ce42f274bd9) Package impersonates the across-protocol organization (published as @across-toolkit/[email protected], a high-version dependency-confusion shape) and ships two postinstall stealer scripts that run automatically on npm install. postinstall.js and eslint-config/postinstall.js read installer-owned secrets from ~/.aws/credentials, ~/.aws/config, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.npmrc, ~/.gitconfig,.env files, /etc/environment, /proc/1/environ, and gcloud application default credentials, and query cloud instance metadata services at http://metadata.google.internal/computeMetadata/v1/ (with the Metadata-Flavor: Google header) and http://169.254.169.254/ for IAM security credentials and OAuth tokens. The collected files, IMDS responses, and a base64-encoded copy of process.env (including NPM_TOKEN) are POSTed via https.request to two hardcoded webhook.site collectors (paths /a585f4ec-20f7-4bd1-bac7-f3e53799dc5f and /12b523e2-ee58-4598-8fe1-bbf1f3999550). The declared package purpose is a shared tsconfig; the network exfiltration and credential harvesting have no relation to that purpose.

References: https://www.npmjs.com/package/@across-toolkit/typescript-config/v/99.0.0, https://www.npmjs.com/package/@across-toolkit/typescript-config/v/99.0.1, https://research.codelake.dev/advisories/clr-2026-3036-across-toolkit-typescript-config