Malicious code in @across-toolkit/typescript-config (npm)
The npm package @across-toolkit/typescript-config is a dependency-confusion credential stealer targeting developers of Across Protocol (across.to). It masquerades as an internal ESLint/TypeScript config for the across.to toolkit and publishes an implausibly high version (99.0.0) so that a misconfigured install resolves it from the public npm registry instead of a private package of the same name — the standard dependency-confusion technique.
A postinstall lifecycle hook (postinstall: node postinstall.js) executes automatically on npm install, before the package is ever imported. Using os.homedir(), the payload reads the host's AWS credentials (~/.aws/credentials), SSH private key (~/.ssh/id_rsa) and npm token (~/.npmrc), collects process.env, and exfiltrates the data via an HTTP POST to a hardcoded webhook.site endpoint (https://webhook.site/a585f4ec-20f7-4bd1-bac7-f3e53799dc5f). The payload is present in both the root postinstall.js and a nested eslint-config/postinstall.js, and uses child_process. Any developer workstation or CI runner that installs the package hands the operator AWS credentials, an SSH private key and an npm publish token.
Detected and classified independently by codelake Research from the live npm feed on 2026-07-16; at the time of reporting the package was not present in OSV or GHSA (verified live) — a first-catch.
Source: amazon-inspector
Package impersonates the across-protocol organization (published as @across-toolkit/[email protected], a high-version dependency-confusion shape) and ships two postinstall stealer scripts that run automatically on npm install. postinstall.js and eslint-config/postinstall.js read installer-owned secrets from ~/.aws/credentials, ~/.aws/config, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.npmrc, ~/.gitconfig,.env files, /etc/environment, /proc/1/environ, and gcloud application default credentials, and query cloud instance metadata services at http://metadata.google.internal/computeMetadata/v1/ (with the Metadata-Flavor: Google header) and http://169.254.169.254/ for IAM security credentials and OAuth tokens. The collected files, IMDS responses, and a base64-encoded copy of process.env (including NPM_TOKEN) are POSTed via https.request to two hardcoded webhook.site collectors (paths /a585f4ec-20f7-4bd1-bac7-f3e53799dc5f and /12b523e2-ee58-4598-8fe1-bbf1f3999550). The declared package purpose is a shared tsconfig; the network exfiltration and credential harvesting have no relation to that purpose.
