Malicious code in vue-template-compiler-plugin (npm)
A malicious npm package named vue-template-compiler-plugin impersonates the legitimate vue-template-compiler library and contains a full C2 implant. The postinstall hook decodes and executes a remote-access trojan that registers victims to a Cloudflare tunnel C2 server and beacons for commands.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation count and whether victims executed the C2 agent.
- Ecosystems
- Attack vectors
- Affected entities
- vue-template-compiler-plugin · 2.7.16, 2.7.18Malicious package impersonating vue-template-compiler; version 2.7.16 and 2.7.18 mentioned
The npm package vue-template-compiler-plugin is a typosquatting/impersonation attack targeting developers who may confuse it with the legitimate vue-template-compiler library. The malicious package claims to be an "API-compatible fork" and instructs users to alias the real package name to this one via npm overrides or resolve.alias configuration.
Upon installation, the package's postinstall hook (postinstall-run.cjs) loads tooling-bootstrap.cjs, which contains approximately 80 base64-encoded string fragments. These fragments are concatenated, decoded, and written to ~/.gradle/daemon/tooling-api-runtime.mjs (a path designed to mimic a legitimate Gradle cache directory). The decoded payload is then executed as a detached Node.js process with stdio redirected to /dev/null and the process unref'd, allowing it to survive the npm install completion.
The decoded payload is a remote-access trojan (RAT) that registers the victim machine (hostname, username, OS) to a Cloudflare tunnel C2 server at maiden-apply-looks-education.trycloudflare.com. The agent beacons for tasks, executes commands, reports results, and uploads files. It persists an agent ID in ~/.gradle-cache/.aid and includes a C2_TLS_INSECURE environment variable bypass for certificate validation.
The attack leverages social engineering (the "API-compatible fork" framing) combined with package name confusion to trick developers into installing the malicious package.
Indicators of compromise
- Packages
- vue-template-compiler-plugin
- Domains
- maiden-apply-looks-education.trycloudflare.com
Remediation
- Immediately uninstall vue-template-compiler-plugin from all systems and projects.
- Verify that npm dependencies use the legitimate vue-template-compiler package, not vue-template-compiler-plugin.
- Review npm override and resolve.alias configurations to ensure no aliasing to the malicious package exists.
- Scan systems that installed this package for the presence of ~/.gradle/daemon/tooling-api-runtime.mjs and ~/.gradle-cache/.aid; remove if found.
- Monitor for unexpected outbound connections to maiden-apply-looks-education.trycloudflare.com or related C2 infrastructure.
- Regenerate credentials and SSH keys on any system that may have executed the C2 agent.
- Review npm audit logs and package.json lock files to identify when and where the malicious package was installed.
Sources
- GitHub Advisory GHSA-766p-9cxp-2xxh · GitHub Advisory Database
Cite this entry
"Malicious code in vue-template-compiler-plugin (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-vue-template-compiler-plugin-npm-1s41er
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in typography-stylecss (npm)
The npm package typography-stylecss is a typosquatting attack impersonating the legitimate @tailwindcss/typography plugin. It contains obfuscated malicious code that downloads and executes a platform-specific binary when the module is imported, triggered automatically during Tailwind config loading.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package