Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
- Disclosed
- Last updated
- Blast radius
- Any Windows user who installed the malicious prettier-lint-lenz package
- Ecosystems
- Attack vectors
- Affected entities
- prettier-lint-lenzMalicious npm package impersonating Prettier
The prettier-lint-lenz npm package is a typosquatting attack that impersonates the popular Prettier code formatter. The package copies the README and description verbatim from the legitimate Prettier project but contains no actual formatter code.
Instead, the malicious package declares a postinstall hook that executes on Windows systems. The hook POSTs an install beacon to a hardcoded C2 server at http://204.10.194.64:5000/api/nonce, copies a bundled prettier-lint/ directory to %LOCALAPPDATA%\prettier-lint, and executes ctll.mjs from the deployed location.
The deployed ctll.mjs establishes persistence by writing a hidden VBScript runner and registering a Windows Scheduled Task named CdllProtect with a LogonTrigger. This task relaunches cdll.mjs via wscript.exe in a hidden window on every user logon, with 999 retries and no execution time limit.
The cdll.mjs component polls the Windows clipboard every ~250ms via powershell.exe Get-Clipboard -Raw and exfiltrates all clipboard contents as JSON to the same C2 endpoint over plain HTTP. This captures passwords, 2FA codes, wallet addresses, and any other copied text. All three attack components share the attacker-controlled endpoint at 204.10.194.64:5000.
Indicators of compromise
- Packages
- prettier-lint-lenz
- IPs
- 204.10.194.64
Remediation
- Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.
Sources
- GitHub Advisory GHSA-pmr5-xc5h-jpmq · GitHub Advisory Database
Cite this entry
"Malicious code in prettier-lint-lenz (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-prettier-lint-lenz-npm-10i3bf
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in typography-stylecss (npm)
The npm package typography-stylecss is a typosquatting attack impersonating the legitimate @tailwindcss/typography plugin. It contains obfuscated malicious code that downloads and executes a platform-specific binary when the module is imported, triggered automatically during Tailwind config loading.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package - containedcritical
Malicious code in exxpress-utils (npm)
The npm package exxpress-utils contained malicious code in a postinstall script that harvested npm/AWS/GitHub credentials, scanned for cryptocurrency wallet extensions, and exfiltrated sensitive files to a hardcoded C2 server. The package was a typosquat of the legitimate 'express' package.
npmCompromised packageTyposquatting