Cybersecurity researchers have found a malicious package deal named “os-info-checker-es6” that disguises itself as an working system info utility to stealthily drop a next-stage payload onto compromised programs.
“This marketing campaign employs intelligent Unicode-based steganography to cover its preliminary malicious code and makes use of a Google Calendar occasion quick hyperlink as a dynamic dropper for its ultimate payload,” Veracode stated in a report shared with The Hacker Information.
“Os-info-checker-es6” was first revealed within the npm registry on March 19, 2025, by a consumer named “kim9123.” It has been downloaded 2,001 occasions as of writing. The identical consumer has additionally uploaded one other npm package deal known as “skip-tot” that lists “os-info-checker-es6” as a dependency. The package deal has been downloaded 94 occasions.
Whereas the preliminary 5 variations exhibited no indicators of knowledge exfiltration or malicious habits, a subsequent iteration uploaded on Might 7, 2025, has been discovered to incorporate obfuscated code within the “preinstall.js” file to parse Unicode “Personal Use Entry” characters and extract a next-stage payload.
The malicious code, for its half, is designed to contact a Google Calendar occasion quick hyperlink (“calendar.app[.]google/
Nonetheless, no extra payloads are distributed at this level. This both signifies that the marketing campaign is both nonetheless a piece in progress, or at the moment dormant. One other chance is that it has already concluded, or that the command-and-control (C2) server is designed to reply solely to particular machines that meet sure standards.
“This use of a respectable, broadly trusted service like Google Calendar as an middleman to host the following C2 hyperlink is a intelligent tactic to evade detection and make blocking the preliminary levels of the assault harder,” Veracode stated.
The applying safety firm and Aikido, which additionally detailed the exercise, additional famous that three different packages have listed “os-info-checker-es6” as a dependency, though it is suspected that the dependent packages are a part of the identical marketing campaign –
- vue-dev-serverr
- vue-dummyy
- vue-bit
“The os-info-checker-es6 package deal represents a complicated and evolving menace inside the npm ecosystem,” Veracode stated. “The attacker demonstrated a development from obvious testing to deploying a multi-stage malware.”
The disclosure comes as software program provide chain safety firm Socket highlighted typoquatting, Go repository caching abuse, obfuscation, multi-stage execution, slopsquatting, and abuse of respectable companies and developer instruments because the six foremost adversarial strategies adopted by menace actors within the first half of 2025.
“To counter this, defenders should give attention to behavioral indicators, comparable to surprising postinstall scripts, file overwrites, and unauthorized outbound visitors, whereas validating third-party packages earlier than use,” safety researchers Kirill Boychenko and Philipp Burckhardt stated.
“Static and dynamic evaluation, model pinning, and shut inspection of CI/CD logs are important to detecting malicious dependencies earlier than they attain manufacturing.”
