Socket discovered six malicious npm packages that typosquat popular libraries, such as chokader for chokidar, sss2h for ssh2 and npmrunnall for npm-run-all.
A postinstall script appends a hardcoded attacker SSH public key to ~/.ssh/authorized_keys, reports the victim’s username and public IP to a webhook-test.com endpoint, and then installs the real library so nothing looks off.
The payload only runs on Linux, and the packages had been downloaded over 700 times while still live on npm, with Socket asking for their removal.
A seventh package, parimiko, borrows the name of the Python SSH library paramiko and carries no malicious code yet, so anyone who doesn’t pin versions would get the malware automatically if a later release adds it.
Unlike previous cases focused on credential harvesting or crypto mining, this campaign directly compromises developer machines at the OS level, potentially giving attackers access to internal infrastructure or CI/CD pipelines.
