Importing the package on Windows launches a bundled remote-control binary. The binary connects to a hard-coded WebSocket C2, runs PowerShell commands, downloads updates, and persists through HKCU Run.
Static reason
No blocking static signals were detected.
Trigger
A consumer imports @types-beta/sdk on Windows.
Impact
Remote command execution and persistent compromise of the importing user's Windows account.
Mechanism
Import-time detached launch of a persistent WebSocket PowerShell agent.
Attack narrative
The package's import side effect launches nanocache.exe without user interaction. Static strings in that executable identify a hard-coded WebSocket agent endpoint, reconnect behavior, a PowerShell command pipeline, update downloading, copying itself to a per-user install directory, and HKCU Run persistence. This is a concrete remote-control and persistence chain.
Rationale
This is not a benign native dependency: importing the package launches a bundled C2-capable PowerShell agent that persists on the host. The absence of an install hook does not mitigate the import-time compromise.
Evidence
package.jsondist/index.jsdist/init.jsvendor/nanocache.exe
Network endpoints1
wss://screen-monitoring-es32.onrender.com/ws/agent