MAL-2026-11499

The npm package `@types-beta/sdk` is a supply-chain dropper that impersonates the trusted `@types` (DefinitelyTyped) namespace to look like a routine type-definition dependency. It bundles a Windows executable (`vendor/nanocache.exe`) and launches it as an import-time side effect: `dist/index.js` calls `init()` at module load, and on Windows `init()` spawns the bundled binary via `child_process` — detached, `stdio: 'ignore'`, `windowsHide: true`. There is no lifecycle install hook; simply importing the package (directly or transitively) executes the payload on Windows.

Static analysis of the bundled binary (it was not executed) shows a WinHTTP WebSocket-based remote-access agent: it dials out to a command-and-control server and maintains a persistent, auto-reconnecting channel (WinHttpConnect / WinHttpWebSocketSend / WinHttpWebSocketReceive), executes remote commands, and starts an interactive PowerShell session. Embedded strings include `[agent] Connecting to %ls:%d (secure=%d)`, `[+] Connected client=%s server=%ls`, `[>] cmd: %s`, and `[shell] PowerShell session started (UTF-8, pipeline mode)`, with `[-] Disconnected, reconnecting in %dms...` for resilience.

Versions 0.1.0-0.1.3 are affected and were live on npm at the time of reporting. Detected and classified independently by codelake Research from the live npm feed; at the time of reporting `@types-beta/sdk` was not present in OSV or GHSA (a first-catch).