Malicious code in @across-toolkit/typescript-config (npm)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

The npm package `@across-toolkit/typescript-config` is a dependency-confusion credential stealer targeting developers of Across Protocol (across.to). It masquerades as an internal ESLint/TypeScript config for the `across.to` toolkit and publishes an implausibly high version (`99.0.0`) so that a misconfigured install resolves it from the public npm registry instead of a private package of the same name — the standard dependency-confusion technique. A `postinstall` lifecycle hook (`postinstall: node postinstall.js`) executes automatically on `npm install`, before the package is ever imported. Using `os.homedir()`, the payload reads the host's AWS credentials (`~/.aws/credentials`), SSH private key (`~/.ssh/id_rsa`) and npm token (`~/.npmrc`), collects `process.env`, and exfiltrates the data via an HTTP `POST` to a hardcoded `webhook.site` endpoint (`https://webhook.site/a585f4ec-20f7-4bd1-bac7-f3e53799dc5f`). The payload is present in both the root `postinstall.js` and a nested `eslint-config/postinstall.js`, and uses `child_process`. Any developer workstation or CI runner that installs the package hands the operator AWS credentials, an SSH private key and an npm publish token. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5580d26d1829c9faf6465962431399aee9804c8ed1264274b30b9ce42f274bd9) Package impersonates the across-protocol organization (published as @across-toolkit/[email protected], a high-version dependency-confusion shape) and ships two postinstall stealer scripts that run automatically on npm install. postinstall.js and eslint-config/postinstall.js read installer-owned secrets from ~/.aws/credentials, ~/.aws/config, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.npmrc, ~/.gitconfig,.env files, /etc/environment, /proc/1/environ, and gcloud application default credentials, and query cloud instance metadata services at http://metadata.google.internal/computeMetadata/v1/ (with the Metadata-Flavor: Google header) and http://169.254.169.254/ for IAM security credentials and OAuth tokens. The collected files, IMDS responses, and a base64-encoded copy of process.env (including NPM_TOKEN) are POSTed via https.request to two hardcoded webhook.site collectors (paths /a585f4ec-20f7-4bd1-bac7-f3e53799dc5f and /12b523e2-ee58-4598-8fe1-bbf1f3999550). The declared package purpose is a shared tsconfig; the network exfiltration and credential harvesting have no relation to that purpose.

Source published

16 Jul 2026 00:00:00 UTC

Source modified

11 Sep 2026 04:00:06 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.