# Typosquat build script payload dropper

Stable zero-dependency package suddenly gains a near-named dependency whose build or install script fetches remote code

_Area: Software supply chain and CI/CD. Seen in 2 disclosed reports; latest 2026-08-20. Updated 2026-10-23._

## How it works
A trusted package's publish credentials are compromised, and the attacker adds one new dependency whose name is a near-miss of a popular package (proc-macro1 vs proc-macro2, easy-day-js). That dependency's build or install script runs automatically when a developer builds or installs the parent, fetching and executing a remote payload with the developer's full privileges. The assumption that breaks: that a package's dependency list is trustworthy and that build-time scripts are benign. Build scripts run at compile time, before any review of the code being built.

## Where it shows up
- A long-stable, zero-dependency crate or package gaining its first-ever dependency [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns.md)[E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-arrayref-rust-crate-supply-chain-attack.md).
- New dependency named like a well-known package, published the same day as the parent's new version [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-arrayref-rust-crate-supply-chain-attack.md).
- Build/install scripts (build.rs, postinstall) that download and execute remote files, especially with TLS verification disabled [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-arrayref-rust-crate-supply-chain-attack.md).
- Caret-pinned dependency resolving to a freshly published malicious patch version [E4](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-mastra-npm-packages-compromised-using-easy-day-js.md).
- Mass republishing of many packages in a tight cluster from one org or maintainer [E4](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-mastra-npm-packages-compromised-using-easy-day-js.md).
- Mass-yanking of stable versions used as a lure [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns.md).

## How to review
Check the registry index diff for the new version: does the manifest add a dependency that did not exist before? For any added dependency, confirm the maintainer matches the impersonated package's author and that the name is not a near-miss. Read the dependency's build.rs or install script: it must not fetch or execute remote code. The invariant: every dependency edge on a stable package is explainable, and no build-time script performs network fetch plus execution. A single unexplained edge is enough to flag.

## Variants seen
- Rust proc-macro typosquat with build.rs dropper injected into zero-dependency crates [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns.md)[E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-arrayref-rust-crate-supply-chain-attack.md)[E3](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack.md).
- npm postinstall dropper via caret-pinned typosquat across 140+ packages [E4](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-mastra-npm-packages-compromised-using-easy-day-js.md).
- Cross-platform stage-2 binary fetched with TLS verification disabled [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-arrayref-rust-crate-supply-chain-attack.md).

## Why fixes fail
Detection initially dismissed the typosquat as low-download noise; the signal was the dependency-graph edge from a high-profile maintainer, not the package itself [E3](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack.md).

## Impact and severity
Backdoor and infostealer execution on developer machines at build time, credential exfiltration to C2 [E3](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack.md)[E4](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-mastra-npm-packages-compromised-using-easy-day-js.md). High severity: runs with full user privileges, spreads transitively to every downstream build, and is invisible in source review of the parent package.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns.md
- E2: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-arrayref-rust-crate-supply-chain-attack.md
- E3: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack.md
- E4: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-mastra-npm-packages-compromised-using-easy-day-js.md