21/08/2026
CloudSEK has uncovered a new npm typosquatting campaign called BRIDGEHEAD.
The attackers published 40 malicious packages designed to look like popular npm libraries. Once installed, the campaign could cross from WSL into Windows and deploy malware targeting crypto wallets, browser credentials, cookies and Telegram sessions.
The most interesting part is not just the fake packages, but how the attackers used WSL as a route into the Windows host and kept the main payload outside npm.
Read the full CloudSEK investigation for the complete attack chain, payload analysis and indicators defenders should know:
CloudSEK’s BRIDGEHEAD investigation exposes a 40-package npm typosquatting campaign that abuses WSL to reach Windows hosts and deploy a concealed Rust-based stealer. The malware targets cryptocurrency wallets, browser credentials, cookies and Telegram sessions, while executing largely in memory an...
