REDIS-TYPE-XYZ · GHSA-vx4h-jq4c-3vg2 · Package
UNINSTALL IT, ROTATE THE KEYS IT COULD READ
Not triaged yet. The sources’ own description is below.
first public Jun 17, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Unknown from the sources.
Unknown from the sources.
The redis-type-xyz package is an empty impersonation of Redis OM. It copies the redis-om-node repository, homepage, author, documentation, and declared dist/index.js entry point, but the published archive does not contain the declared dist directory or any usable implementation. Its dependency list replaces the legitimate ulid package used by Redis OM with ulid-xyz@^2.12.2.
Installing redis-type-xyz therefore installs the known-malicious ulid-xyz dependency. The ulid-xyz postinstall hook launches a detached background agent that decodes a WebSocket and HTTP C2 endpoint at 95.216.232.162:8010. The agent supports system information collection, drive and directory enumeration, removal, and deploy_binary tasks. deploy_binary writes attacker-supplied Base64 content to disk, registers persistence on Windows, macOS, or Linux, and launches the replacement agent. The malicious ulid-xyz dependency is independently tracked as MAL-2026-6672. redis-type-xyz is a separate delivery package that intentionally substitutes the known-malicious dependency into an otherwise copied Redis OM manifest.
-= Per source details. Do not edit below this line.=-
Package is published as 'redis-type-xyz' but its README markets itself as 'redis-type-os', uses Redis branding/logo, and declares its repository as github:redis/redis-om-node — impersonating Redis's official redis-om library. The package's package.json declares main as 'dist/index.js' and types as './dist/index.d.ts', but no dist/ directory is present in the tarball, so require('redis-type-xyz') will throw MODULE_NOT_FOUND. The package is not a functional library. Its only on-install effect is dependency resolution: it declares a runtime dependency on 'ulid-xyz' (^2.12.2), a name-confusion variant of the legitimate 'ulid' package. Any consumer installing redis-type-xyz will transitively pull ulid-xyz from an unrelated publisher. The naming pattern (impersonation of a well-known library + a sibling 'xyz'-suffixed dep mirroring a popular package) is a name-confusion / namespace-lure shape, but the contents of ulid-xyz itself were not analyzed in this record and no installer-harm payload (exfiltration, install hooks, credential reads) is observed in the parent package's tarball. Routing to human review to assess intent of the ulid-xyz transitive and the impersonation pattern.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.