- Malicious npm package "https-proxy-utils" delivered the AdaptixC2 agent via a post-install script.
- Attack used typosquatting to mimic widely downloaded proxy utilities in the npm ecosystem.
- Cross-platform delivery supported Windows, macOS, and Linux with architecture-aware payloads.
- Researchers published IoCs and mitigation tips, noting the package was removed from npm.
In October 2025, security analysts at Kaspersky detailed a supply chain compromise targeting the npm ecosystem that smuggled the AdaptixC2 post‑exploitation agent through a look‑alike package named https-proxy-utils. The package posed as a proxy helper but quietly fetched and ran an AdaptixC2 payload during installation.
The operation leaned on classic typosquatting against popular npm modules. By echoing names like http-proxy-agent (~70M weekly downloads) and https-proxy-agent (~90M), and cloning behavior from proxy-from-env (~50M), the rogue package increased its credibility — until the hidden post-install script handed over control to AdaptixC2. At reporting time, the impostor had been removed from the npm registry.
Cross-platform payload delivery
Investigators report that the installer adapted to the host OS with distinct loading and persistence routines. On Windows, the agent arrived as a DLL under C:\Windows\Tasks. The script copied the legitimate msdtc.exe into that directory and executed it to sideload the malicious library — a pattern mapped to MITRE ATT&CK technique T1574.001 (DLL Search Order Hijacking).
On macOS, the script dropped an executable into Library/LaunchAgents and created a plist for autorun. Before download, the logic checked the CPU family and retrieved the appropriate build, x64 or ARM, to fit the target system.
Linux hosts received an architecture‑matched binary in /tmp/.fonts-unix, where the script set execute permissions for immediate start. That CPU-aware delivery (x64/ARM) ensured the agent could run consistently across diverse fleets.
Across platforms, the post-install hook acted as an automatic trigger, requiring no manual user action once the developer installed the package — a key reason why supply chain abuse in package managers remains so disruptive.
What AdaptixC2 enables and why this matters
First made public in early 2025 — and seen in malicious use as early as spring — AdaptixC2 is framed as a post‑exploitation framework comparable to Cobalt Strike. Once implanted, operators can perform remote access, command execution, file and process management, and pursue multiple persistence options.
These features help adversaries sustain access, run reconnaissance, and stage follow‑on actions inside developer environments and CI/CD infrastructure. In short, a tampered dependency can flip a routine install into a reliable foothold for lateral movement.
The npm incident also fits a broader pattern. Just weeks earlier, the Shai‑Hulud worm spread via post-install techniques to hundreds of packages, underscoring how attackers continue to weaponize trusted open‑source supply chains.
Kaspersky’s analysis attributes the npm delivery to a convincing impostor that blended real proxy functionality with hidden installation logic. The combination made the threat harder to spot during casual reviews of code or package metadata.
Practical steps and indicators to watch
Organizations can reduce exposure by tightening package hygiene: verify exact names before installation, scrutinize new or unpopular repositories, and track security advisories for signs of compromised modules. Where possible, pin versions, mirror vetted artifacts, and gate builds with policy‑as‑code and SBOM checks.
Key package and hashes
- Package name: https-proxy-utils
- DFBC0606E16A89D980C9B674385B448E – package hash
- B8E27A88730B124868C1390F3BC42709
- 669BDBEF9E92C3526302CA37DC48D21F
- EDAC632C9B9FF2A2DA0EACAAB63627F4
- 764C9E6B6F38DF11DC752CB071AE26F9
- 04931B7DFD123E6026B460D87D842897
Network indicators
- cloudcenter[.]top/sys/update
- cloudcenter[.]top/macos_update_arm
- cloudcenter[.]top/macos_update_x64
- cloudcenter[.]top/macosUpdate[.]plist
- cloudcenter[.]top/linux_update_x64
- cloudcenter[.]top/linux_update_arm
While the offending npm package has been taken down, teams should audit recent dependency installs, hunt for the above indicators, and review systems for unexpected binaries in C:\Windows\Tasks, Library/LaunchAgents, or /tmp/.fonts-unix — especially where post-install scripts were permitted to run.
The AdaptixC2 npm case brings together credible impersonation, automated cross‑platform deployment, and capable C2 tooling, illustrating how a single dependency can open the door to long‑lived access; sustained vigilance around package selection, build pipelines, and telemetry is essential to blunt this style of attack.
