A normal package import on Windows starts a detached native binary. The binary is a screen-monitoring remote agent with PowerShell execution, update, and per-user persistence capabilities.
Static reason
No blocking static signals were detected.
Trigger
Consumer imports @types-beta/sdk on Windows.
Impact
Screen capture and remote command execution with persistence.
Mechanism
Import-time detached launch of bundled remote-control executable
Attack narrative
Importing the SDK calls init(), which launches nanocache.exe detached and hidden on Windows. Static inspection of that bundled executable shows screen-capture APIs, a hard-coded WebSocket command server, PowerShell session support, self-update logic, and HKCU Run persistence. This is concealed remote-control behavior unrelated to an SDK.
Rationale
The package uses an import-time side effect to execute a bundled Windows remote-control agent. Its capture, command, persistence, and network capabilities establish concrete malicious behavior.
Evidence
package.jsondist/index.jsdist/init.jsvendor/nanocache.exe
Network endpoints1
wss://screen-monitoring-es32.onrender.com/ws/agent