redis-type-xyz

Details

**Severity:** Critical

**Affected versions:** `= 1.10.6`

The redis-type-xyz package is an empty impersonation of Redis OM. It copies the redis-om-node repository, homepage, author, documentation, and declared dist/index.js entry point, but the published archive does not contain the declared dist directory or any usable implementation. Its dependency list replaces the legitimate ulid package used by Redis OM with ulid-xyz@^2.12.2.

Installing redis-type-xyz therefore installs the known-malicious ulid-xyz dependency. The ulid-xyz postinstall hook launches a detached background agent that decodes a WebSocket and HTTP C2 endpoint at 95.216.232.162:8010. The agent supports system information collection, drive and directory enumeration, removal, and deploy_binary tasks. deploy_binary writes attacker-supplied Base64 content to disk, registers persistence on Windows, macOS, or Linux, and launches the replacement agent. The malicious ulid-xyz dependency is independently tracked as MAL-2026-6672. redis-type-xyz is a separate delivery package that intentionally substitutes the known-malicious dependency into an otherwise copied Redis OM manifest.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/93c874ee0e8a44e3f4e0fcdeab2c87088f7365a8/osv/malicious/npm/redis-type-xyz/MAL-2026-11205.json))

**References:**
- https://github.com/ossf/malicious-packages/issues/1373
- https://github.com/ossf/malicious-packages/blob/93c874ee0e8a44e3f4e0fcdeab2c87088f7365a8/osv/malicious/npm/redis-type-xyz/MAL-2026-11205.json
- https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ulid-xyz/MAL-2026-6672.json
- https://www.npmjs.com/package/redis-type-xyz/v/1.10.6
- https://github.com/advisories/GHSA-9c7w-936w-35px

Compromised versions (1)

• = 1.10.6

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.