Cybersecurity Startup Publishes Infostealers to NPM

A coordinated supply-chain campaign published multiple typosquatted npm packages impersonating AI and security tooling; install-time scripts (preinstall/postinstall) silently collected developer identity and environment metadata (hostnames, git emails, SSH key comments, reflog committer emails, cloud profiles, project metadata, CI indicators) and exfiltrated it via Google Cloud Run (project 228835561205) to endpoints in europe-west1 and us-central1, with roughly 20k downloads across packages. The packages were iteratively refined (April -> June), included social-engineering elements (typosquats, backfilled versions, plausible README/opt-outs), and were linked to a single npm account associated with a known cybersecurity startup founder; indicators and mitigations (ignore install-time scripts, monitor run.app egress) are provided.