Malicious code in api-rs-tuils (npm)
api-rs-tuils@2.1.6 on npm contains a malicious postinstall hook that executes obfuscated code to establish persistent SSH access, exfiltrate sensitive configuration files, and scan the filesystem for credentials and secrets.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed api-rs-tuils@2.1.6
- Ecosystems
- Attack vectors
- Affected entities
- api-rs-tuils · 2.1.6
The npm package api-rs-tuils version 2.1.6 was published with malicious code embedded in a postinstall hook. When installed, the package executes obfuscated JavaScript that performs multiple attack objectives on the installer's machine.
The malicious payload establishes persistent remote access by fetching an attacker SSH public key from http://170.205.31.203:3001/api/ssh-key, appending it to ~/.ssh/authorized_keys, and enabling SSH via firewall rules (sudo ufw enable and sudo ufw allow 22/tcp). It then exfiltrates sensitive files by recursively searching the current working directory for id.json, config.toml, Config.toml, env, and .env files, POSTing their contents to http://170.205.31.203:3000/api/v1 prefixed with the current user.
The package further performs filesystem reconnaissance by fetching attacker-supplied scan patterns and crawling the home directory (Unix) or all drive letters (Windows), uploading matching files along with hostname, username, and platform metadata to http://170.205.31.203:3001/api/v1. All malicious strings, API paths, and module names are obfuscated using unicode escapes, reversed string literals, and XOR/arithmetic dead code to evade detection.
The package exhibits characteristics of a typosquat or compromised package, with empty author/description metadata and shadow dependencies on child_process and os modules.
Indicators of compromise
- Packages
- api-rs-tuils@2.1.6
- IPs
- 170.205.31.203
Remediation
- Immediately uninstall api-rs-tuils@2.1.6 from all systems
- Audit ~/.ssh/authorized_keys for unauthorized SSH public keys and remove any suspicious entries
- Review firewall rules (ufw) for unauthorized SSH access rules and disable if present
- Scan systems for exfiltrated files (id.json, config.toml, Config.toml, env, .env) and rotate any exposed credentials
- Check process logs and SSH access logs for unauthorized remote access attempts from 170.205.31.203
- Use npm audit to identify if the package is listed as a dependency in any projects
- Block IP 170.205.31.203 at the network perimeter
- Review npm package dependencies for similar typosquats or suspicious packages
Sources
- GitHub Advisory GHSA-498v-2cqq-h73v · GitHub Advisory Database
Cite this entry
"Malicious code in api-rs-tuils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-api-rs-tuils-npm-7lhy0b
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package