AI-SDK-name typosquats on npm harvest git/SSH/cloud identity — anthropic-toolkit, ai-sdk-helpers, @langgraphjs/toolkit and more (~20K downloads, removed)

TL;DR

A single npm publisher account ran a months-long typosquatting campaign impersonating AI SDK tooling by name — anthropic-toolkit (mimics Anthropic's Claude SDK), ai-sdk-helpers (mimics Vercel's ai SDK), @langgraphjs/toolkit (mimics LangChain's LangGraph.js), ollama-helpers, and openai-agents-helpers — plus two unrelated fake Argon2 password-hashing packages from the same actor. Install hooks silently profiled the developer's machine (hostname, git/GitHub identity, SSH key comments, cloud account IDs, CI platform) and exfiltrated it to a Google Cloud Run endpoint. Combined downloads across all packages were roughly 20,000; packages and the publishing account were taken down after disclosure.

What happened

OpenSourceMalware identified five npm packages, all first published between April and June 2026, that specifically typosquat the names developers reach for when integrating popular AI agent/SDK tooling rather than generic utility-package names:

The same publisher also shipped two unrelated fake Argon2 password-hashing packages from April 2026 (@aspect-security/argon2 1.0.1, argon2-napi 1.0.0). Combined weekly/monthly downloads across the full set were on the order of 20,000 at disclosure time.

Data harvested — OpenSourceMalware documents 11 distinct categories collected via a preinstall/postinstall hook: machine hostname and OS username; git identity (from ~/.gitconfig and project-local config); GitHub CLI identity (~/.config/gh/hosts.yml); up to 15 unique committer emails pulled from the last 50 git reflog entries; the origin remote URL; SSH public-key comments from ~/.ssh/*.pub (not private key material); cloud identity — GCP project/account from ~/.config/gcloud/properties and AWS profile names/SSO URLs/account IDs from ~/.aws/config (the report notes credential values were explicitly skipped, only identity metadata was taken); the host's corporate DNS domain via /etc/resolv.conf; the parent project's package.json name/author/repository; CI-platform detection (GitHub Actions, GitLab CI, Jenkins, CircleCI, Travis, Buildkite); and basic runtime metadata (Node version, OS, CPU arch, timestamp). Exfiltration went to Google Cloud Run URLs (npm-package-logger-228835561205.{region}.run.app), sharing a single embedded GCP project number (228835561205) across every artifact — a strong signal all packages are one operator. A fake "telemetry opt-out" environment variable was offered as cover.

OpenSourceMalware attributes the publishing account to the founder of a still-in-stealth-mode, Israel-based cybersecurity startup, but deliberately declined to name the company or individual. Xygeni's weekly malicious-code digest, published independently, corroborates the same five package names and confirms the campaign was still active on 2026-07-07 — all five received incremented versions that day (anthropic-toolkit 1.3.1, ai-sdk-helpers 1.4.5, openai-agents-helpers 1.3.3, @langgraphjs/toolkit 1.2.13, ollama-helpers 1.2.3) as part of what Xygeni calls a continuing "AI-tooling impersonation pattern" — meaning the campaign continued for weeks after OpenSourceMalware's private disclosure (made in late June 2026) until the public writeup and takedown on 2026-07-09. Both packages and the publishing account have since been removed from npm.

No CVE has been assigned — this is npm-registry malware, not a bug in a specific package version of a legitimate project.

Am I affected?

# Check any Node project for these package names, at any version
npm ls anthropic-toolkit ai-sdk-helpers ollama-helpers openai-agents-helpers "@langgraphjs/toolkit" "@aspect-security/argon2" argon2-napi --all 2>/dev/null

grep -E '"(anthropic-toolkit|ai-sdk-helpers|ollama-helpers|openai-agents-helpers|@langgraphjs/toolkit|@aspect-security/argon2|argon2-napi)"' \
  package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null

# Look for outbound traffic to the exfil endpoint in shell/proxy history
grep -r 'npm-package-logger-228835561205' ~/.bash_history ~/.zsh_history 2>/dev/null

None of these are real Anthropic, Vercel, LangChain, Ollama, or OpenAI packages — the legitimate SDKs are @anthropic-ai/sdk, ai (Vercel), @langchain/langgraph, ollama, and openai/@openai/agents respectively.

If you are affected

→ playbooks/if-you-installed-a-bad-npm-package.md — this campaign is reconnaissance-only (no credential values, private keys, or wallet material were exfiltrated per the source), but the harvested git/GitHub/CI identity and cloud account IDs are enough to build a targeted follow-on attack; treat any host that ran an affected version as having disclosed its developer and CI identity to an unknown third party. → playbooks/auditing-a-vibe-coded-repo.md

Prevention

→ prevention/package-vetting-checklist.md — verify you're installing the vendor's actual published package name before adding an AI-SDK dependency. → prevention/npm-hardening.md

Why this matters for vibe coders

This is a purpose-built variant of typosquatting that targets the exact package names a vibe coder reaches for when wiring up an AI SDK — Claude, Vercel AI SDK, LangGraph, Ollama, OpenAI Agents — rather than generic high-traffic utility names. The recon-only payload (profiling git/CI/cloud identity without stealing secret values) matches the pattern this repo has previously flagged in the npm dependency-confusion campaign: a reconnaissance-first stage is often a precursor to a larger, more damaging follow-on wave, so a package match here is worth investigating even though nothing was directly stolen.

Sources

• OpenSourceMalware — Cybersecurity Startup Publishes Infostealers to npm — primary technical writeup, full IOC list, package/version table, exfil endpoint.
• Xygeni — Malicious Code Digest #78 — independent corroboration, confirms campaign was still active with new versions as of 2026-07-07.