Malicious code in fast-glob-fast (npm)
The npm package fast-glob-fast is a typosquat of the legitimate fast-glob package that contains malicious postinstall code. The malware appends an attacker-controlled SSH public key to ~/.ssh/authorized_keys and exfiltrates system identifiers to a remote server, establishing persistent SSH backdoor access.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious fast-glob-fast package during the active period.
- Ecosystems
- Attack vectors
- Affected entities
- fast-glob-fastTyposquat of fast-glob package
The npm package fast-glob-fast is a typosquat targeting the legitimate fast-glob package. Upon installation, a malicious postinstall script executes on the victim's system.
The postinstall script performs two primary malicious actions. First, it resolves the user's SSH authorized_keys file path across multiple platforms (Darwin, Linux, Windows), creates the ~/.ssh directory if it does not exist, and appends a hardcoded SSH public key (ssh-ed25519 AAAAC3NzaC1lZDI1NTE5... dkhrustalev) to the authorized_keys file using appendFileSync. This grants the attacker persistent SSH access to any system where the package is installed.
Second, the script collects system identifiers including username, hostname, non-internal MAC address, platform, and architecture. If the FAST_GLOB_FAST_EVENT_URL environment variable is set, the script POSTs a JSON event containing these identifiers to the configured URL, optionally including a Bearer token from FAST_GLOB_FAST_EVENT_TOKEN. This provides the attacker with a registry of compromised hosts.
The combination of SSH key injection and host-identifier exfiltration constitutes a canonical SSH-persistence backdoor delivered via typosquatting.
Indicators of compromise
- Packages
- fast-glob-fast
- Hashes
- 92ced9e788505da600a8b79bef3678101e5a0480e6b8ddb754e9472c8a63cf63
Remediation
- Immediately uninstall fast-glob-fast from all systems: npm uninstall fast-glob-fast
- Audit ~/.ssh/authorized_keys on all affected systems and remove any unfamiliar SSH public keys, particularly ssh-ed25519 keys with the dkhrustalev identifier
- Review SSH access logs for unauthorized remote access attempts from the compromise date forward
- Change SSH keys and credentials on any affected systems
- Install the legitimate fast-glob package instead: npm install fast-glob
- Implement package name verification and typosquat detection in your dependency management workflow
- Consider using npm audit or similar tools to detect known malicious packages
Sources
- GitHub Advisory GHSA-g926-74f8-mw6v · GitHub Advisory Database
Cite this entry
"Malicious code in fast-glob-fast (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-fast-glob-fast-npm-1pw8r2
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package