MAL-2026-11499

Dashboard / Malicious Package / MAL-2026-11499

MAL-2026-11499

Summary: Malicious code in @types-beta/sdk (npm)

Details: The npm package `@types-beta/sdk` is a supply-chain dropper that impersonates the trusted `@types` (DefinitelyTyped) namespace to look like a routine type-definition dependency. It bundles a Windows executable (`vendor/nanocache.exe`) and launches it as an import-time side effect: `dist/index.js` calls `init()` at module load, and on Windows `init()` spawns the bundled binary via `child_process` — detached, `stdio: 'ignore'`, `windowsHide: true`. There is no lifecycle install hook; simply importing the package (directly or transitively) executes the payload on Windows. Static analysis of the bundled binary (it was not executed) shows a WinHTTP WebSocket-based remote-access agent: it dials out to a command-and-control server and maintains a persistent, auto-reconnecting channel (WinHttpConnect / WinHttpWebSocketSend / WinHttpWebSocketReceive), executes remote commands, and starts an interactive PowerShell session. Embedded strings include `[agent] Connecting to %ls:%d (secure=%d)`, `[+] Connected client=%s server=%ls`, `[>] cmd: %s`, and `[shell] PowerShell session started (UTF-8, pipeline mode)`, with `[-] Disconnected, reconnecting in %dms...` for resilience. Versions 0.1.0-0.1.3 are affected and were live on npm at the time of reporting. Source: amazon-inspector (5a3bdb989bdab8b3038c0eb791bf3e09ee753c363d198162f54420b82d9326ed) The package masquerades as a type-definitions package in the @types-beta/* namespace but ships a 1.1 MB Windows executable at vendor/nanocache.exe. The main entry dist/index.js calls init() at module load time, which on Windows spawns vendor/nanocache.exe with detached: true, stdio: "ignore", windowsHide: true, then child.unref()s it, so a hidden background process starts whenever a consumer writes `import "@types-beta/sdk"`. The bundled PE (sha256 9a65f46787db4dd1e278a06f617094c59ca113ee92f6a8021b62967bb64b947a) contains embedded strings consistent with a remote-control agent (`/ws/agent`, `disconnect`, `update`, `exit_code`). The README reinforces the impersonation by contrasting the package with `@types-beta/node` as "type definitions only", while this package auto-executes native code on import. Import-time launch of an opaque, undocumented native binary with agent-shaped protocol strings on a namespace crafted to imitate DefinitelyTyped constitutes a backdoor installation on the developer's host.

References: https://research.codelake.dev/advisories/clr-2026-3041-types-beta-sdk, https://www.npmjs.com/package/@types-beta/sdk/v/0.1.1, https://www.npmjs.com/package/@types-beta/sdk/v/0.1.0, https://www.npmjs.com/package/@types-beta/sdk/v/0.1.2, https://www.npmjs.com/package/@types-beta/sdk/v/0.1.3