Malicious code in @ai_/autoprefixers (npm)
@ai_/autoprefixers is a typosquat of the legitimate autoprefixer package that executes arbitrary attacker-controlled shell commands on installation. The malicious code fetches encrypted payloads from remote C2 servers and decrypts them using a hardcoded key suffix before execution via child_process.exec.
- Disclosed
- Last updated
- Blast radius
- Any consumer installing and importing @ai_/autoprefixers receives arbitrary shell command execution.
- Ecosystems
- Attack vectors
- Affected entities
- @ai_/autoprefixers
@ai_/autoprefixers is a typosquatting attack targeting the popular autoprefixer npm package. Upon require, the malicious lib/autoprefixer.js module loads the child_process module via base64-obfuscated strings and establishes communication with attacker-controlled C2 infrastructure.
The attack mechanism involves fetching AES-256-CBC encrypted ciphertext from http://player.sweeprovider.org/getKey.php and a decryption key from http://player.sweeprovider.org/generateRandomKey.php. The payload is decrypted using a helper function with a hardcoded key suffix (47e01aba1e12cf6d) and then executed as arbitrary shell commands via child_process.exec, also obfuscated in base64.
Any developer or system that installs and imports this package is immediately compromised with arbitrary code execution capabilities. The attacker maintains the ability to change the delivered payload at any time through the C2 endpoint, enabling dynamic attack evolution.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @ai_/autoprefixers
- Domains
- player.sweeprovider.org
Remediation
- Immediately uninstall @ai_/autoprefixers from all systems and projects
- Audit npm install logs and dependency trees to identify all systems that may have installed this package
- Assume any system that installed this package has been compromised; perform forensic analysis and consider full system rebuild
- Use the legitimate autoprefixer package instead, verifying the correct package name and publisher
- Implement npm package name verification and typosquatting detection in your supply chain security tooling
- Monitor for any suspicious outbound connections to player.sweeprovider.org or related C2 infrastructure
- Review and rotate any credentials or secrets that may have been exposed on affected systems
Sources
- GitHub Advisory GHSA-8hhx-8x59-hr55 · GitHub Advisory Database
Cite this entry
"Malicious code in @ai_/autoprefixers (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-ai-autoprefixers-npm-i6t6zx
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in express-chai (npm)
express-chai, a malicious npm package impersonating the pino logger middleware, contained obfuscated code that fetches and executes arbitrary code from a remote server (https://gray-dyane-31.tiiny.site/index.json) at middleware initialization time, granting full Node.js process access to an attacker.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in helmet-pro (npm)
helmet-pro@10.0.4 is a typosquat of the legitimate helmet package that executes malicious code during npm install via a postinstall hook. The malicious code fetches and executes arbitrary JavaScript from a remote attacker-controlled endpoint, enabling remote code execution on the installer's machine.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in tailwindcss-hide-scrollbar (npm)
The npm package tailwindcss-hide-scrollbar contains malicious code that executes on import/require. The package is a typosquat of the legitimate tailwind-scrollbar-hide plugin and includes obfuscated code that attempts to interact with Ethereum blockchain nodes and RPC endpoints.
npmTyposquattingCompromised package - containedcritical
Malicious code in @atom8n/inspector (npm)
The npm package @atom8n/inspector contained malicious code that impersonated Anthropic's official Model Context Protocol (MCP) inspector while intentionally disabling security protections. The package exposed developers to arbitrary remote code execution via a localhost proxy that accepted commands from any web origin.
npmModel hubCompromised packageTyposquatting