TOPHIT Part 1: A one-operator npm typosquat flood, co-hosted with a GPU-cryptojacking C2

On 15 September 2026 an npm account @prime0 published 85 scoped typosquatting packages that mimic popular libraries; installing or loading these packages causes the code to fingerprint the host and poll a C2 at 69.48.229.140:8080 every 30 seconds for shell commands, with no authentication or encryption. The package names are algorithmically generated to appear in search/autocomplete (scoped packages rank above missing unscoped names), making developers more likely to select them; the same host also runs a separate GPU-cryptojacking panel. The report recommends blocking the C2 IP at egress, searching manifests and lockfiles for @prime0, and detecting on the shipped code and network sequence rather than package names.