What the npm registry remembers

Fri, 06 Nov 2026 16:15:00 +0000

When npm takes down a malicious release, the tarball and its manifest go. Most of the rest stays, and it is enough to rebuild an incident to the second without touching a sample. This note covers what survives, how to read it with curl and jq, and what it says about three compromises: axios (March 2026), the easy-day-js dependency behind the Mastra compromise (June 2026), and the phishing of the maintainer qix (September 2025). The last part is about turning it into a detector, graft, and what it took to stop that detector flagging ordinary releases.

A raw TCP backdoor behind the cleverstack git hook lure

Mon, 02 Nov 2026 18:23:00 +0000

Summary

Update, 6 November 2026: an earlier build from April with a different C2, see the update at the end.

Two JavaScript files uploaded to MalwareBazaar on 10 July 2026 and tagged BeaverTail don’t behave like BeaverTail. They skip the HTTP endpoints that BeaverTail is known for (/pdown, /client/<id>, /uploads, /keys) and open a plain TCP connection to 5.230.122[.]63:15152. Over it they send newline-delimited JSON status messages and run whatever the server sends back as a shell command. A Windows batch file uploaded in the same few minutes, also anonymously, installs a portable Node.js and pulls that backdoor down as loader.js from cleverstack-ext30341.vercel[.]app, the same Vercel C2 that Snyk and a developer’s write-up tied to the Contagious Interview git hook lure. I could not find a public report of the TCP backdoor or of the address and port. ThreatFox and URLhaus had nothing on either when I checked on 2 November 2026; the indicators below have since been submitted to both.

n4uu

What the npm registry remembers

A raw TCP backdoor behind the cleverstack git hook lure

Summary