Malicious code in @ai_/autoprefixers (npm)
@ai_/autoprefixers is a typosquat of the legitimate autoprefixer package that executes arbitrary attacker-controlled shell commands on installation. The malicious code fetches encrypted payloads from remote C2 servers and decrypts them using a hardcoded key suffix before execution via child_process.exec.
- Disclosed
- Last updated
- Blast radius
- Any consumer installing and importing @ai_/autoprefixers receives arbitrary shell command execution.
- Ecosystems
- Attack vectors
- Affected entities
- @ai_/autoprefixers
@ai_/autoprefixers is a typosquatting attack targeting the popular autoprefixer npm package. Upon require, the malicious lib/autoprefixer.js module loads the child_process module via base64-obfuscated strings and establishes communication with attacker-controlled C2 infrastructure.
The attack mechanism involves fetching AES-256-CBC encrypted ciphertext from http://player.sweeprovider.org/getKey.php and a decryption key from http://player.sweeprovider.org/generateRandomKey.php. The payload is decrypted using a helper function with a hardcoded key suffix (47e01aba1e12cf6d) and then executed as arbitrary shell commands via child_process.exec, also obfuscated in base64.
Any developer or system that installs and imports this package is immediately compromised with arbitrary code execution capabilities. The attacker maintains the ability to change the delivered payload at any time through the C2 endpoint, enabling dynamic attack evolution.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @ai_/autoprefixers
- Domains
- player.sweeprovider.org
Remediation
- Immediately uninstall @ai_/autoprefixers from all systems and projects
- Audit npm install logs and dependency trees to identify all systems that may have installed this package
- Assume any system that installed this package has been compromised; perform forensic analysis and consider full system rebuild
- Use the legitimate autoprefixer package instead, verifying the correct package name and publisher
- Implement npm package name verification and typosquatting detection in your supply chain security tooling
- Monitor for any suspicious outbound connections to player.sweeprovider.org or related C2 infrastructure
- Review and rotate any credentials or secrets that may have been exposed on affected systems
Sources
- GitHub Advisory GHSA-8hhx-8x59-hr55 · GitHub Advisory Database
Cite this entry
"Malicious code in @ai_/autoprefixers (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-ai-autoprefixers-npm-i6t6zx
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in sigchain-js (npm)
Malicious code was injected into the published npm package sigchain-js, executing arbitrary code on installation via DES-decrypted payloads from companion packages thedata and tchain-api. The attack also involved typosquatting axios to version 1.18.1, which does not exist in legitimate release history.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in rollup-runtime-core-polyfills (npm)
The npm package rollup-runtime-core-polyfills contained malicious code that impersonated a legitimate rollup polyfill plugin. On every import/require, it decoded and executed a shell command to install an attacker-controlled package (svgcraft-core) and executed code from it, affecting any build system that consumed this package.
npmCompromised packageTyposquatting - containedcritical
Malicious code in text-line-parser (npm)
The npm package text-line-parser contained malicious code in its postinstall.js that collected system information, environment variables (including CI tokens and cloud credentials), and exfiltrated them to a Burp Collaborator domain. The package advertised itself as a text-parsing utility but shipped only stub functions, consistent with a typosquat/decoy supply-chain attack.
npmCompromised packageTyposquatting - containedcritical
Malicious code in parallely (npm)
The npm package parallely contains malicious code that impersonates the legitimate concurrently package. When invoked, it executes a dropper that downloads and runs platform-specific payloads after anti-analysis checks.
npmCompromised packageTyposquatting