OpenHack Blog

Insights on application security, vulnerability research, and building secure software at scale.

Threat IntelligenceAnnouncements
Thirty-seven npm typosquat packages converging through Windows and WSL into an infostealer targeting credentials, cryptocurrency wallets, and Telegram data
Threat Intelligence11 min read

Inside a 37-Package npm Typosquatting Campaign Targeting Windows and WSL

OpenHack correlated 37 npm typosquats carrying the same install-time dropper, decoded its XOR-obfuscated configuration, and traced a Windows and WSL infostealer chain from npm postinstall to credential exfiltration.

Ananay AroraAnanay Arora·
Introducing OpenHack — the open-source AI security agent
Announcements6 min read

Introducing OpenHack: The Open-Source AI Security Agent

OpenHack is now live — an open-source AI security agent that hunts, validates, and verifies real vulnerabilities in your code. It runs on open-source models at 40× the cost-efficiency of Claude Opus 4.6 on CVE-Bench.

Ananay AroraAnanay Arora·