The npm account justhunter has published 10 packages over the past eight days. The names target real project namespaces: rnx-align-deps (Microsoft React Native tools), load-nuxt and load-nuxt-dev (Nuxt.js), shopify-internel (a Shopify typosquat), annotator-harvardx (HarvardX), and gen-ai-opt-in. Several describe themselves as “Security research canary.” All carry version numbers in the 99.x range. At least one, gen-ai-opt-in, runs a postinstall script that collects the developer’s IP address, hostname, username, and geolocation and sends it to a Burp Suite Collaborator endpoint. Others appear to be passive namespace claims carrying no executable code beyond a README that reads “Takeover By lobo.”
The packages
Ten packages, all from justhunter, published between late June and early July 2026.
gen-ai-opt-in (v99.0.2, 513 weekly downloads) is the only package in the set for which we have the full source. It ships a postinstall.js (1.12 KB). The npm README reads “Takeover By lobo” and “acrobot adobe com.”
load-nuxt (v99.0.3, 152 weekly downloads) ships only a package.json and a README. No postinstall script. The README reads “Takeover By lobo.”
The remaining eight are listed on the account profile. Six of them (some-theme, nonexistent-package, hook-augmenting-module, load-nuxt-dev, nuxt-fonts-devtools, and load-nuxt) are described as “Security research canary — vercel.” Two (annotator-harvardx and shopify-internel) are described as “Build tool for Cloudflare Workers and Service Workers.” rnx-align-deps is described as “Security research canary.”
All carry version numbers in the 99.x range. In a dependency confusion attack, a high major version ensures the public registry copy wins over any internal or private-registry package with the same name.
What gen-ai-opt-in does
The postinstall checks that it is running inside an npm install (not when required as a module) and exits otherwise. It then calls ip-api.com to resolve the installer’s public IP address and geolocation. It collects:
- Public IP address
- Hostname and username (from the OS)
- City, region, country, ISP, and organization (from the geo lookup)
It sends all of it as query string parameters via an HTTP GET request to:
hxxp://p1r2d74iwjk057raam6myf7e258wzkt8i[.]oastify[.]com/That hostname is a Burp Suite Collaborator callback. Burp Collaborator is a tool built by PortSwigger for out-of-band security testing. Security researchers use it to confirm that a target system made an outbound request, proving a vulnerability exists. The request is HTTP (not HTTPS), so the payload travels in the clear.
The collection is lighter than what typical infostealers gather. There are no credentials, no API keys, no SSH keys, no config files, no shell history. The postinstall reads nothing from disk beyond the OS hostname and username.
Why it looks like research
Several packages label themselves “Security research canary.” The callback goes to Burp Collaborator, a tool designed for authorized penetration testing. The version numbers follow the 99.x convention used in dependency confusion proofs of concept. The data collected (IP and geolocation) is the minimum needed to prove an internal package name was resolved from the public registry and installed on a corporate machine.
This matches the profile of a dependency confusion test: claim a package name that should be private, set a high version, add a postinstall that phones home, and see which organizations install it.
Why it still matters
The packages run code on developers’ machines without consent. The 513 weekly downloads on gen-ai-opt-in mean real developers triggered the postinstall and had their IP, hostname, username, and location sent to a third-party endpoint. Whether the sender is a researcher or an attacker does not change that.
Authorized dependency confusion tests are coordinated with the target organization. The researcher has a scope agreement, and the data goes to an endpoint the target controls or has approved. There is no public disclosure, coordination notice, or contact information in any of the 10 packages. The README says “Takeover By lobo.” It does not say who lobo is, who authorized the test, or how to report a finding.
For a defender, the response is the same regardless of intent: block the packages, check whether they ran, and treat the exfiltrated data as leaked.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| npm account | justhunter | Publisher of all 10 packages |
| npm package | gen-ai-opt-in@99.0.2 | Postinstall exfiltration to Burp Collaborator |
| Callback | p1r2d74iwjk057raam6myf7e258wzkt8i[.]oastify[.]com | Burp Suite Collaborator endpoint (HTTP) |
| npm package | rnx-align-deps@99.0.7 | Namespace claim targeting Microsoft React Native |
| npm package | shopify-internel@99.0.1 | Namespace claim (Shopify typosquat) |
| npm package | annotator-harvardx@9.0.2 | Namespace claim targeting HarvardX |
| npm packages | load-nuxt@99.0.3, load-nuxt-dev@99.0.3, nuxt-fonts-devtools@99.0.3 | Namespace claims targeting Nuxt.js |
| npm packages | some-theme@99.0.3, nonexistent-package@99.0.3, hook-augmenting-module@99.0.3 | Namespace claims (“Security research canary”) |
What a defender can do
Set ignore-scripts=true in .npmrc. The gen-ai-opt-in postinstall is the only confirmed active payload in this set, and it relies entirely on the postinstall hook.
If gen-ai-opt-in was installed without --ignore-scripts, assume the postinstall ran. The exfiltrated data (IP, hostname, username, city, region, country, ISP, organization) was sent over plaintext HTTP to a Burp Collaborator endpoint. The data is exposed to the endpoint adversary and to anyone on the network path.
Check whether any of the 10 package names match internal or private-registry names in your organization. If they do, the v99.x version will win a resolution race against your private package unless your registry is configured to scope or pin internal names.
Use registry scoping or a private registry proxy that blocks public packages from shadowing internal names. This is the structural fix for dependency confusion, regardless of whether the packages are research or malware.
Where Aephix fits
Intent does not change the observable behavior. A postinstall that sends your IP and hostname to a third-party endpoint looks the same whether the sender has a scope agreement or not. For a defender, the question is not “is this research?” but “was this authorized in my environment?”
Aephix Sleuth links a flagged package to the wider operation behind it, with a confidence level and supporting evidence. In this case, the adversary published 10 packages in eight days, all targeting established namespaces, all carrying v99.x versions. Whether they are a researcher or a threat actor, the footprint is on file and the next package from the same account is recognized on sight.