WSL is a working bridge, and npm hygiene stops at the container wall

WSL's boundary is a convenience for the developer, not a control for the defender, and BRIDGEHEAD reads it that way. The courier does its work inside the Linux userland where the dependency landed: profile the host, report to a command and control server, then test for a Windows machine underneath ^[3]. The only feature the campaign needed from the registry was the install script, which all forty packages carried ^[2]. Registry allowlists, lockfiles, a private mirror, a review gate on new dependencies: all of that governs what gets into the userland, which is the side of the line with nothing on it worth stealing. The paths the stealer carries resolve into the Windows user profile, including Brave directories that did not exist on the analysis machine ^[15], and by the time CloudSEK captured guest memory it had already built a hardware profile of the box and staged the multipart header for the upload ^[16].

The takedown record is the part to take into a vendor conversation. According to CloudSEK the two halves of the campaign had opposite lifespans: the npm layer cheap and disposable, the payload layer one GitHub release asset plus a route out through a public file host, and the unpublishing touched neither ^[17]. Across the window observed on 17 August the asset was being pulled at roughly 3.2 times an hour with no live package left to advertise it ^[19]. It stopped being available when the bebraz1 account itself returned 404, four hours after the last reading and only because analysts were watching ^[8]. CloudSEK's own summary is that the npm takedown left the weapon in place ^[9].

The file is also a lesson in what size tells you. 265 kilobytes of the 22 megabyte binary is code, and 98.6 per cent of it is one unbroken run of 22,638,592 hexadecimal characters ^[10], which decode to 11,319,296 bytes of encrypted stage ^[20]. A Rust executable that is roughly one per cent program and the rest a hex string is an anomaly a build or download pipeline could measure by arithmetic alone, and it is close to the only static signal on offer, because the runtime behaviour is designed to produce none ^[11]. The upload lands on gofile.io, which CloudSEK points out is a legitimate service and cannot be seized the way a criminal domain can ^[13].

One caveat on sourcing: this is CloudSEK's investigation, published 20 August 2026 ^[18], and the packages are already gone ^[1], so the forty-name list is no longer checkable against the live registry.