lint-builder
lint-builder is a malicious npm package used in the Contagious Trader campaign, a large cryptocurrency-focused malware operation assessed with high confidence as linked to North Korea and overlapping with Lazarus-associated activity. It was observed as a typosquatted or malicious dependency in fake GitHub cryptocurrency trading bot repositories, including Polymarket-themed projects hosted from the hijacked dev-protocol GitHub organization. In the documented infection chain, big-nunber depended on lint-builder, and lint-builder executed automatically during npm install via a postinstall hook that ran node test.js. The malware then contacted attacker-controlled Vercel infrastructure, including cloudflareinsights.vercel.app, to retrieve scan and block patterns and to exfiltrate stolen data via /api/v1. Reported behavior includes fingerprinting victims by requesting their public IP from api.ipify.org, scanning for sensitive files such as .env and other credential-bearing files, exfiltrating collected data, taking ownership of the victim’s SSH directory, enabling ufw, and opening inbound SSH on port 22 to facilitate persistent access. StepSecurity observed exfiltration of .env data and SSH-related host modification in a monitored sandbox. The package was specifically identified as critical in repositories such as dev-protocol/polymarket-copytrading-bot-sport, where it was pulled in through big-nunber. The broader campaign targeted cryptocurrency users with fake trading bots themed around Polymarket, Kalshi, Solana, Raydium, and copy trading, and used Vercel-hosted infrastructure named to resemble legitimate Cloudflare services.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The following image shows a specific publish notification for npm user responsible for packages lint-builder (malware) and big-nunber (benign intermediary that depends on lint-builder ) leveraged in the Contagious Trader campaign.
The following image shows a specific publish notification for npm user responsible for packages lint-builder (malware) and big-nunber (benign intermediary that depends on lint-builder ) leveraged in the Contagious Trader campaign.
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
The malware uses two Vercel-hosted endpoints, both named to impersonate Cloudflare services: cloudflareguard.vercel.app ... cloudflareinsights.vercel.app ... The naming strategy is deliberate: both cloudflareguard and cloudflareinsights are plausible Cloudflare service names.
Discovery
2 techniques
Discovery
Lateral Movement
1 technique
Lateral Movement
Collection
1 technique
Collection
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malicious npm package used in the Contagious Trader campaign, distributed through intermediary dependency chains and associated with cloudflareinsights.vercel[.]app.
Malicious npm package that executes via postinstall, downloads C2 instructions, steals data, fingerprints the victim, and opens SSH access by modifying firewall settings and taking control of the SSH directory.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.