# Install-time remote payload dropper

Install or build hooks that fetch and run remote code, or read secrets from process memory

_Area: Software supply chain and CI/CD. Seen in 6 disclosed reports; latest 2026-10-12. Updated 2026-11-02._

## How it works
A package's install-time or build-time hook (npm preinstall/postinstall, a Python import hook, a Gradle/Xcode build phase) runs code the registry never reviewed. The assumption that breaks is that installing a dependency is passive: the hook fetches a second stage from a remote host and executes whatever the server returns, so the published package is only a launcher and the real payload can change per victim. Because the hook runs with the developer's or CI runner's identity, it inherits their tokens, keys and memory [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-apex-accelerator-malicious-npm-packages.md)[E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md)[E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-shai-hulud-2-0-ongoing-supply-chain-attack.md)[E5](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-flutter-package-on-pub-dev-contains-xcsset-malware.md).

## Where it shows up
- preinstall/postinstall/prepare scripts, or a `__init__.py` import hook, that download a runtime or blob and exec it [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-apex-accelerator-malicious-npm-packages.md)[E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md)[E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-shai-hulud-2-0-ongoing-supply-chain-attack.md)
- Launchers that POST to a C2 and execute returned `exec`/`args`/`cmd` fields [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-apex-accelerator-malicious-npm-packages.md)
- Phantom dependencies added to a popular package's manifest [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md)
- Repackaged upstream OSS with a small bootstrap that overrides API base URLs via env vars [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-apex-accelerator-malicious-npm-packages.md)
- Build files in `example/`, `test/`, `build.gradle.kts`, `project.pbxproj`, `.git/hooks` that are never compiled as dependencies [E5](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-flutter-package-on-pub-dev-contains-xcsset-malware.md)
- Obfuscated shell (`printf|tr`), renamed system binaries, reads of `/proc/*/mem`, `task_for_pid`, `ReadProcessMemory` [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md)[E5](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-flutter-package-on-pub-dev-contains-xcsset-malware.md)
- OIDC env vars used to mint registry tokens; self-hosted runner registrations in workflows [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md)[E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-shai-hulud-2-0-ongoing-supply-chain-attack.md)

## How to review
The invariant: no dependency's install or build step may execute code fetched at runtime, and no hook may read credentials or process memory. Check every lifecycle script and import hook resolves to code shipped in the tarball; diff vendored/repackaged OSS against upstream hashes and inspect bootstrap files for base-URL overrides [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-apex-accelerator-malicious-npm-packages.md). Confirm the phantom dependency directory exists and matches its manifest — droppers delete `setup.js` and swap in a clean stub, so `ls node_modules/<dep>` is the durable check [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md). Verify publishing uses OIDC Trusted Publishing with no long-lived token that can override it [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md).

## How finders spotted it
- A supply-chain monitor bot flagged odd behavior in one package; researchers linked it to a prior campaign, then found the sibling package and analyzed sites, packages and malware [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-apex-accelerator-malicious-npm-packages.md)
- Analysts diffed new package versions, deobfuscated the import hook, decrypted the blobs and traced the bootstrap, scrapers and C2 [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md)
- An SOC analyst saw `C:\ProgramData\wt.exe` across multiple hosts and orgs — a cross-tenant pattern, not one anomaly — then traced the chain to the dropper and recognized `wt.exe` as renamed powershell [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md)
- Researchers watched npm publications and GitHub activity for anomalous preinstall scripts and exfil repos, then reverse-engineered the payload [E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-shai-hulud-2-0-ongoing-supply-chain-attack.md)
- A researcher scanned pub.dev tarballs, found obfuscated shell in `example/` build files, and matched `printf|tr` patterns and C2 domains to known malware modules [E5](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-flutter-package-on-pub-dev-contains-xcsset-malware.md)

## Variants seen
- npm launcher downloading platform-specific Bun executables that call a C2 [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-apex-accelerator-malicious-npm-packages.md)
- Repackaged legitimate agent with a bootstrap redirecting LLM traffic [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-apex-accelerator-malicious-npm-packages.md)
- PyPI import hook downloading an encrypted modular payload [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md)
- Hijacked maintainer account publishing a backdoored popular package plus phantom dependency [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md)
- Worm via preinstall scripts self-spreading through stolen tokens [E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-shai-hulud-2-0-ongoing-supply-chain-attack.md)
- Infected maintainer machine injecting build hooks into `example/` files [E5](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-flutter-package-on-pub-dev-contains-xcsset-malware.md)

## Impact and severity
Reached credential and wallet theft, LLM traffic interception, OIDC token minting with forged provenance, org-wide secret exfiltration, SSH lateral movement and cloud escalation; one campaign exposed 25K+ repos [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-apex-accelerator-malicious-npm-packages.md)[E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md)[E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-shai-hulud-2-0-ongoing-supply-chain-attack.md). Impact rose with CI runner secrets in memory, self-spreading, and wiper deterrents delaying revocation [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md)[E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-shai-hulud-2-0-ongoing-supply-chain-attack.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **universal_file_viewer** (example/ build files (Gradle, Xcode pbxproj, git hooks)) 0.1.5: Compromised Flutter package on pub.dev contains XCSSET malware. Report: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-flutter-package-on-pub-dev-contains-xcsset-malware.md
- **ensmallen** (__init__.py import hook) 0.8.101: The Hades Campaign: Graph ML PyPI Packages Deploy Cross-Platform Memory Scrapers, AI Analyst Misdirection, and a Wiper D. Report: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-apex-accelerator-malicious-npm-packages.md
- E2: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-the-hades-campaign-pypi-packages.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-supply-chain-compromise-axios-npm-package.md
- E4: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-shai-hulud-2-0-ongoing-supply-chain-attack.md
- E5: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-flutter-package-on-pub-dev-contains-xcsset-malware.md