Lone attacker published 14 malicious npm packages mimicking popular OpenSearch, Elasticsearch libraries
Microsoft says a single npm user published 14 malicious packages in four hours, using typosquatting to steal cloud and CI/CD secrets.
Intelligence analysis by GPT-5.4 Mini
A new supply-chain campaign targeted developers by impersonating OpenSearch and Elasticsearch-related npm packages. Microsoft says the packages carried credential-stealing payloads aimed at AWS, HashiCorp Vault, GitHub Actions, and npm tokens.
Someone put fake tool boxes in a big online store where programmers download helpers. The fake boxes looked like real ones from OpenSearch and Elasticsearch, so people could be fooled into grabbing them.
When a computer opened one of the fake boxes, it could secretly send back important login keys and other private bits. It was like a toy box that, instead of toys, had a hidden walkie-talkie calling a thief.
Microsoft says the fake tools were removed. People who used them should check their computers and change any secret keys that might have been stolen.
Analysis
What happened
Microsoft says a lone npm user published 14 malicious packages on Thursday within a four-hour span. The packages pretended to be legitimate OpenSearch, Elasticsearch, DevOps, and environment-configuration libraries, and were designed to target AWS, HashiCorp Vault, GitHub Actions, and the npm registry itself.
How the attack worked
The attacker used typosquatting and lookalike names such as opensearch-setup-tool, opensearch-config-utility, and elastic-opensearch-helper to trick developers into installing them. Microsoft also says the packages copied upstream metadata by pointing homepage, repository, and bugs fields at the real github.com/opensearch-project/opensearch-js project. Some packages also used inflated version numbers like 1.0.7265, 1.0.9108, and 2.1.9201 to appear mature.
The malicious code executed through install-time hooks. Microsoft describes a first-stage loader that ran during install, preinstall, or postinstall, gathered host details such as hostname, platform, architecture, Node version, user names, working directory, and package metadata, then sent that data to the attacker. The server responded with a second-stage payload saved as payload.bin. Microsoft says one variant re-ran that payload on later require() calls, creating quiet persistence across CI stages and rebuild loops.
A later loader variant tried to be stealthier by checking whether Bun was already installed. If not, it downloaded the legitimate Bun runtime v1.3.13 and then launched the payload. The second stage was described as a 195 KB credential harvester built for cloud and CI/CD environments.
Impact
Microsoft says the malicious libraries have been removed. The company advises teams to check whether they installed or built affected versions on or after May 28 and to rotate AWS IAM/STS, HashiCorp Vault, npm publish, and GitHub Actions tokens that may have been exposed.
Key points
- Microsoft says 14 malicious npm packages were published by one user in about four hours.
- The packages impersonated OpenSearch and Elasticsearch-related libraries using typosquatting and lookalike names.
- The payloads targeted cloud and CI/CD secrets, including AWS, HashiCorp Vault, GitHub Actions, and npm tokens.
- One loader variant persisted by re-running the payload on later module loads; another used Bun as part of its staging.
- Microsoft says the packages were removed and affected teams should rotate exposed credentials.
