A new npm typosquatting malware campaign, identified in August 2026, targets Windows software developers using Windows Subsystem for Linux (WSL). This Rust-based malware is delivered through 40 typosquatted npm packages that imitate popular JavaScript libraries. Once installed, a postinstall script executes to download an executable from GitHub, allowing the malware to steal cryptocurrency wallets, browser credentials, and messaging session data.
The attack exploits the connection between WSL and the Windows host to evade detection. It uses sophisticated techniques, including in-memory execution and dynamic network communications to ensure the malware remains undetected by typical security measures. Defense strategies include strict package verification, using private npm registries, and monitoring for unexpected outbound connections.