Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in prettier-lint-lenz (npm)

The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any Windows user who installed the malicious prettier-lint-lenz package
Ecosystems
Attack vectors
Affected entities
  • prettier-lint-lenzMalicious npm package impersonating Prettier

The prettier-lint-lenz npm package is a typosquatting attack that impersonates the popular Prettier code formatter. The package copies the README and description verbatim from the legitimate Prettier project but contains no actual formatter code.

Instead, the malicious package declares a postinstall hook that executes on Windows systems. The hook POSTs an install beacon to a hardcoded C2 server at http://204.10.194.64:5000/api/nonce, copies a bundled prettier-lint/ directory to %LOCALAPPDATA%\prettier-lint, and executes ctll.mjs from the deployed location.

The deployed ctll.mjs establishes persistence by writing a hidden VBScript runner and registering a Windows Scheduled Task named CdllProtect with a LogonTrigger. This task relaunches cdll.mjs via wscript.exe in a hidden window on every user logon, with 999 retries and no execution time limit.

The cdll.mjs component polls the Windows clipboard every ~250ms via powershell.exe Get-Clipboard -Raw and exfiltrates all clipboard contents as JSON to the same C2 endpoint over plain HTTP. This captures passwords, 2FA codes, wallet addresses, and any other copied text. All three attack components share the attacker-controlled endpoint at 204.10.194.64:5000.

Indicators of compromise

Packages
  • prettier-lint-lenz
IPs
  • 204.10.194.64

Remediation

  • Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.

Sources

  1. GitHub Advisory GHSA-pmr5-xc5h-jpmq · GitHub Advisory Database

Cite this entry

"Malicious code in prettier-lint-lenz (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-prettier-lint-lenz-npm-10i3bf

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. containedcritical

    Malicious code in hardhat-core (npm)

    The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.

    npmTyposquattingCompromised package
  2. containedcritical

    Malicious code in typography-stylecss (npm)

    The npm package typography-stylecss is a typosquatting attack impersonating the legitimate @tailwindcss/typography plugin. It contains obfuscated malicious code that downloads and executes a platform-specific binary when the module is imported, triggered automatically during Tailwind config loading.

    npmTyposquattingCompromised package
  3. containedcritical

    Malicious code in prisma-callback (npm)

    prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.

    npmTyposquattingCompromised package
  4. containedcritical

    Malicious code in exxpress-utils (npm)

    The npm package exxpress-utils contained malicious code in a postinstall script that harvested npm/AWS/GitHub credentials, scanned for cryptocurrency wallet extensions, and exfiltrated sensitive files to a hardcoded C2 server. The package was a typosquat of the legitimate 'express' package.

    npmCompromised packageTyposquatting