APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API

big.js Typosquat SSH Backdoor

discovered 2026-04-09

Cluster of big.js and biginteger typosquats (sjs-biginteger, bjs-biginteger, cjs-biginteger and lint-builder variants) that implant SSH backdoors and steal developer keys.

Objective

Implant SSH backdoors and steal developer keys via typosquats.

Packages

npmsjs-bigintegerattributed-to
npmsjs-lint-build1attributed-to
npmbjs-bigintegerattributed-to
npmbjs-lint-builderattributed-to
npmbjs-lint-buildersattributed-to
npmcjs-bigintegerattributed-to
npmts-lint-buildsattributed-to

Indicators

domaincloudflareinsights.vercel.appcommunicates-with
domaincloudflarefirewall.vercel.appcommunicates-with
sha25655bee3abfa26a78989baae1053a778d3b4a984d5451621a851211a45fe2a82b9indicates
sha25602a00a158ceedaaf7a4bf53002a74d60339d4668d463831fe218905816b72e07indicates
sha2569d2037fc0ad9ada672d30e17a9496cbde392c5093a9fde0b8f16d28e2e0c50c7indicates
sha2567bff4518f4d49ddf3d04d8167a6f5f17aed9b3703290f65cf71c61ea61f0a7bcindicates
sha256aa36d4bee44ee1d35af0e211e8cca957044c782b177787b1181d18d6d6323037indicates
sha256f4914c528cf92a7e97ac3b24138afb86b4cd9db6960d92ffbbff36a1fb90ead9indicates
sha256fc095d3e6a613e27d267d80b448101ef78b02ec07dd3993c734202839015fb54indicates
sha25686f60a2196c3d1355efdcfee41f1549c30c6081bf6c106d11e44a64691f8ebd3indicates
emailvanes.s.p.orit.a@googlemail.comexfiltrates-to
emailsupport@polymarket.comexfiltrates-to

Techniques

ttpT1195.001 Compromise Software Dependencies and Development Toolsuses
ttpT1059.007 JavaScriptuses
ttpT1036 Masqueradinguses
ttpT1552.001 Credentials In Filesuses
ttpT1041 Exfiltration Over C2 Channeluses
ttpT1552.004 Unsecured Credentials: Private Keysuses
ttpT1105 Ingress Tool Transferuses
ttpT1071.001 Web Protocolsuses
ttpT1546 Event Triggered Executionuses
ttpT1027 Obfuscated Files or Informationuses

Read the full analysis

APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API