@types-beta/sdk@0.1.3
Malicious code in @types-beta/sdk (npm)
Analysis
@types-beta/sdk@0.1.3 is a combosquat package impersonating the @types/beta scope. When imported at application startup, dist/init.js spawns vendor/nanocache.exe as a hidden, detached Windows process. The bundled PE binary is a "Screen Monitor Agent" RAT that connects via WebSocket to wss://nanocache-optimizer[.]onrender[.]com/ws/agent, captures screen content via GDI+, executes remote commands, and enforces a singleton mutex (Local\ScreenMonitorAgentMutex). The C2 server is nanocache-optimizer[.]onrender[.]com on port 443 (WebSocket secure). The package has no repository and no legitimate purpose.
- analyzed by
- Leitwacht
- first seen
- Jul 28, 2026, 09:09 PM
- analyzed
- Jul 28, 2026, 09:10 PM
Related advisories
- system-performance-helper@1.0.1
- express-mongo-limit@2.0.1
- pinokio-redis@1.0.127
- zredis-typed@1.0.127
- zod-pino434@1.0.127
- pino-zod@1.0.121
- zod-pino@1.0.122
- shadxino@1.0.7
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.