Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

npm typosquat → developer workstation → corporate VPN

Publish a typosquat npm package; the developer's `npm install` runs the postinstall script, exfils SSH keys + VPN profile, then connects to the corporate network.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target organisation uses Node.js heavily. Developers run `npm install` without strict-allowlist policies and have VPN profiles + SSH keys on their laptops.

§ Steps

  1. 01
    Connect via stolen VPN profileInitial Access
    T1078— Valid Accounts
  2. 02
    Wait for developer installInitial Access
    T1078— Valid Accounts
  3. 03
    Exfil ~/.ssh, ~/.aws, VPN profileCredential Access
    T1552— Unsecured Credentials
  4. 04
    Pick a likely typosquat nameInitial Access
    SUP-NPM-TYPOSQUAT— npm / PyPI / RubyGems Typosquat
  5. 05
    Publish package with postinstall payloadExecution
    SUP-INSTALL-SCRIPT— Malicious Install Script
  6. 06
    Internal pivotDiscovery
    N-NMAP-INTERNAL— Internal Nmap Sweep

§ References

§ Frequently asked

What is the "npm typosquat → developer workstation → corporate VPN" attack path?
Publish a typosquat npm package; the developer's `npm install` runs the postinstall script, exfils SSH keys + VPN profile, then connects to the corporate network. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Connect via stolen VPN profile (T1078) — a initial access primitive. Assumed environment: target organisation uses Node.
What is the final impact of this kill-chain?
The final step lands on Internal pivot (N-NMAP-INTERNAL), which falls under Discovery. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers