/
← Voltar ao feed
medium technology software development

Researcher squats 21 npm names matching bin entries of Google-scoped packages, using postinstall fingerprint beacons

1 fonte(s) · 1 atualização(ões) · publicado 13/08/2026 21:00 · coletado há 1 dia

On August 12, 2026, an npm user (rootdaddy-msrc, author field r00tdaddy) published 21 packages that squatted the unscoped CLI binary names declared in the bin field of Google-affiliated scoped packages, such as ngsw-config (from @angular/service-worker) and bazelisk (from @bazel/bazelisk). Scoped publishing, registry allowlists and lockfile pinning do not cover this gap, because a scoped package's binary name cannot include the scope. Each package carried a minimal postinstall beacon that sent a system fingerprint to a per-package subdomain under jchunt[.]top. The activity looks like a dependency confusion proof of concept, probably prepared for responsible disclosure. All packages were unpublished within hours.

Technical Details

  • Pipeline: query Google-affiliated scoped packages for bin entries, strip the scope, check for missing standalone packages on the public registry, then register them.
  • Each package contained package.json with a postinstall hook, postinstall.js, and source.txt with a commit-SHA permalink to the originating Google repository. The description read "Security research canary for authorized vulnerability testing."
  • The beacon sent hostname, platform, CPU architecture, Node version, package name and npm lifecycle event via HTTPS POST to <random>.instances.poc.jchunt[.]top/<package-name>. It collected no credentials, tokens, files or environment variables.
  • Discovery: 18 of the 21 names matched confirmed bin entries in public npm packages, including localize-extract, localize-translate, gaarf, gaarf-bq, gaarf-node, gaarf-node-bq, chromecast-webdriver-cli, karma-proxy, gemini-cli-a2a-server and bazelisk. Three (broadcast-graphics-mcp, upload-to-gcp, tfjs-inference) came from Sourcegraph and GitHub crawling of names never published to npm.
  • Publication came in two waves on August 12, about four hours apart. The unpublish window of about 32 seconds and alphabetical ordering suggest automation. Two packages used the fabricated version 3.2.1 (for gaarf) instead of 1.0.0.
  • Unlike earlier "npx confusion" research (alxndrsn 2024, Carta and Khan at DEF CON 33, Aikido), this campaign targets npm install postinstall hooks and so automated build pipelines, not developers running npx.
  • Infrastructure: wildcard DNS *.instances.poc.jchunt[.]top resolves to 152.53.138.110, and the apex jchunt[.]top sits behind Cloudflare (104.21.61.226, 172.67.216.7). Artifacts were recovered from npmmirror.com.

Remediation

  • Audit the bin entries exposed by every package in your npm scopes and register the unscoped names as placeholder packages on the public registry.
  • Never reference internal tools as bare dependencies. Always consume them through their scoped package name.
  • Review build logs and DNS/egress telemetry for connections to jchunt[.]top and its subdomains.

Linha do tempo

  1. safedep.io ↗ · pub. 13/08/2026 21:00 · coletado 19/10 18:03 primeiro registro

    Researcher squats 21 npm names matching bin entries of Google-scoped packages, using postinstall fingerprint beacons

    ler a análise desta fonte

    On August 12, 2026, an npm user (rootdaddy-msrc, author field r00tdaddy) published 21 packages that squatted the unscoped CLI binary names declared in the bin field of Google-affiliated scoped packages, such as ngsw-config (from @angular/service-worker) and bazelisk (from @bazel/bazelisk). Scoped publishing, registry allowlists and lockfile pinning do not cover this gap, because a scoped package's binary name cannot include the scope. Each package carried a minimal postinstall beacon that sent a system fingerprint to a per-package subdomain under jchunt[.]top. The activity looks like a dependency confusion proof of concept, probably prepared for responsible disclosure. All packages were unpublished within hours.

    Technical Details

    • Pipeline: query Google-affiliated scoped packages for bin entries, strip the scope, check for missing standalone packages on the public registry, then register them.
    • Each package contained package.json with a postinstall hook, postinstall.js, and source.txt with a commit-SHA permalink to the originating Google repository. The description read "Security research canary for authorized vulnerability testing."
    • The beacon sent hostname, platform, CPU architecture, Node version, package name and npm lifecycle event via HTTPS POST to <random>.instances.poc.jchunt[.]top/<package-name>. It collected no credentials, tokens, files or environment variables.
    • Discovery: 18 of the 21 names matched confirmed bin entries in public npm packages, including localize-extract, localize-translate, gaarf, gaarf-bq, gaarf-node, gaarf-node-bq, chromecast-webdriver-cli, karma-proxy, gemini-cli-a2a-server and bazelisk. Three (broadcast-graphics-mcp, upload-to-gcp, tfjs-inference) came from Sourcegraph and GitHub crawling of names never published to npm.
    • Publication came in two waves on August 12, about four hours apart. The unpublish window of about 32 seconds and alphabetical ordering suggest automation. Two packages used the fabricated version 3.2.1 (for gaarf) instead of 1.0.0.
    • Unlike earlier "npx confusion" research (alxndrsn 2024, Carta and Khan at DEF CON 33, Aikido), this campaign targets npm install postinstall hooks and so automated build pipelines, not developers running npx.
    • Infrastructure: wildcard DNS *.instances.poc.jchunt[.]top resolves to 152.53.138.110, and the apex jchunt[.]top sits behind Cloudflare (104.21.61.226, 172.67.216.7). Artifacts were recovered from npmmirror.com.

    Remediation

    • Audit the bin entries exposed by every package in your npm scopes and register the unscoped names as placeholder packages on the public registry.
    • Never reference internal tools as bare dependencies. Always consume them through their scoped package name.
    • Review build logs and DNS/egress telemetry for connections to jchunt[.]top and its subdomains.