Typosquat npm chain ioredis-xyz → redis-type-xyz → ulid-xyz delivers MicrosoftSystem64 RAT, linked to DPRK FAMOUS CHOLLIMA

Linha do tempo

1. safedep.io ↗ · pub. 01/09/2026 07:00 · coletado 19/10 18:03 primeiro registro

   Typosquat npm chain ioredis-xyz → redis-type-xyz → ulid-xyz delivers MicrosoftSystem64 RAT, linked to DPRK FAMOUS CHOLLIMA

   ler a análise desta fonte ocultar

   SafeDep flagged the malicious npm package ulid-xyz in June 2026. It typosquats ulidx and is a cross-platform remote access trojan. It is delivered through a three-layer transitive dependency chain: ioredis-xyz (a clone of the legitimate ioredis client) depends on redis-type-xyz (an empty manifest posing as Redis OM), which in version 1.10.6 added ulid-xyz@^2.12.2 carrying the payload. The operator added the payload 19 minutes after publication without republishing the visible top-level package, and planted the chain in 28 purpose-built attacker GitHub repositories. SafeDep assesses overlaps with the FAMOUS CHOLLIMA (Contagious Interview) DPRK-linked cluster: the same implant name MicrosoftSystem64, port 8010, Hetzner hosting, and the whisdev persona owning two of the 28 repositories. No second stage appears in any published archive, so the actual impact on specific machines is unknown.

   Technical Details

   • The postinstall hook looks like a check that dist/node/utils.js exists, but it actually launches that file as a detached process, which starts dist/node/payload.js, a 467 KB bundled trojan. The package grew from 64 KB to 536 KB.
   • The launcher exits if the machine has fewer than four processors, evading analysis sandboxes and CI runners.
   • The agent decodes an obfuscated configuration (Base64 plus repeating XOR key) and beacons over WebSocket to two command servers, 65.21.30.171 and 95.216.232.162 (Hetzner, Germany). MAL-2026-6672 records only the second address.
   • Capabilities: ping, get_system_info, list_drives, list_dir, deploy_binary (writes a Base64 binary to disk, installs persistence and restarts into it) and remove_agent. The bundle does not steal credentials itself.
   • Persistence under the name MicrosoftSystem64: scheduled task on Windows, LaunchAgent on macOS, systemd user unit on Linux.
   • ioredis-xyz 5.11.2 is byte-identical to ioredis except for package.json and adds the unused dependency redis-type-xyz@^1.10.5. Version 1.10.6 of redis-type-xyz added ulid-xyz@^2.12.2, so the semver range pulled in the payload for every resolution.
   • redis-type-xyz contains 33 non-executable files and its README still references redis-type-os, which npm removed 18 hours earlier (MAL-2026-5882). ulid-xyz declares ten dependencies, including a WebSocket client and a package named postinstall.
   • The packages were published by two accounts using disposable addresses on the same domain root. Related advisories: MAL-2026-6672 (ulid-xyz) and MAL-2026-11205 (redis-type-xyz).
   • The earlier MicrosoftSystem64 implant (81 MB Node.js single executable, delivered via js-logger-pack and terminal-logger-utils) used 195.201.194.107:8010, stole browser credentials, over 80 crypto wallet extensions, Telegram sessions and SSH keys, and exfiltrated to HuggingFace. It is the likely second stage delivered through deploy_binary.

   Remediation

   • Remove ioredis-xyz, redis-type-xyz and ulid-xyz from projects and lockfiles, and treat hosts that installed them as compromised: hunt for MicrosoftSystem64 persistence (scheduled task, LaunchAgent, systemd user unit).
   • Block and hunt for connections to 65.21.30.171, 95.216.232.162 and 195.201.194.107, especially on port 8010.
   • Rotate credentials, SSH keys and wallet secrets on any affected developer machine.
   • Verify package names against the legitimate ioredis and ulidx, review transitive dependencies, and use malicious-package scanning in the install pipeline.