GajShield Threat Advisory — DirtyBlanket npm Worm and CHAOS Linux Backdoor

Severity: High | Priority: 1

DirtyBlanket is a supply-chain worm spread through nine fake Express and React packages that the npm account dirtyblanket published on September 29, 2026. Names include express-javascript, express-nodejs, react-nodejs and xeprews. When one of these is installed on Linux, a preinstall hook downloads a worm script. The script installs a backdoor based on the open-source CHAOS remote-access tool, which reports to its operator over a Tor hidden service.

The worm then spreads three ways:

• SSH: it uses every passphrase-less SSH private key it can read to log into the hosts listed in known_hosts and the SSH configs.
• AUR: it pushes a malicious install line into Arch User Repository packages the victim maintains.
• npm: it publishes infected patch versions of the victim’s own npm packages using any .npmrc tokens it finds.

If a detection is raised on a Linux machine, treat the machine and every key and token on it as compromised, and isolate it from your network. The backdoor installs as /usr/lib/systemd/systemd-fontrenderd with an immutable flag, together with systemd services named systemd-fontrenderd and systemd-fontcached. Non-root copies sit under ~/.config/systemd/.

To remove it:

1. Clear the immutable flags with chattr -i.
2. Stop and disable both services.
3. Delete the backdoor binaries and service files, then rebuild the machine where possible.

Next, contain the spread:

1. Rotate every SSH key that existed on the machine.
2. Check each host in its known_hosts for the same files, for a /tmp/log file, and for changes to authorized_keys.
3. Revoke and reissue every npm token found in .npmrc files.
4. Review your published npm packages for unexpected patch versions that add a preinstall hook.
5. If you maintain AUR packages, look for unexpected pkgrel bumps and .install lines that download scripts.

If a detection is raised on a downloaded package or file that has not been installed, delete it and remove the package from your projects and lockfiles. Then check whether any machine on your network ran npm install with it. Block the Tor hidden service, s5n2uyo6gb6dhirsm5pihwohi6e7ayrwojx4xjow4cqabmbowpezenid.onion, and the staging repository, codeberg.org/hellscripter/install-scripts. The script was also fetched through Wayback Machine copies of that repository, so check web.archive.org requests in your logs as well.