cyrokai's scanners flagged a same-day cluster of malicious npm packages published under the atlasora- prefix, all at version 1.0.0. They share a prefix, a publish date, and an identical payload, so we treat them as a single campaign.
The classification is Masquerading: the names impersonate a legitimate atlasora SDK suite, but none ship any real functionality. Every package carries the same install hook, install.js (SHA-256 5849f99b3c22a51b079d3d793718c0b48cde0e1c6ed7d7738edaf87e8e01eb88, 3681 bytes), which runs on install to gather host and environment data and exfiltrate it. In short, they are info-stealers.
| Package | Version | Payload | Infection method |
|---|---|---|---|
atlasora-shared | 1.0.0 | install.js | Masquerading |
atlasora-config | 1.0.0 | install.js | Masquerading |
atlasora-utils | 1.0.0 | install.js | Masquerading |
atlasora-types | 1.0.0 | install.js | Masquerading |
atlasora-sdk | 1.0.0 | install.js | Masquerading |
atlasora-api | 1.0.0 | install.js | Masquerading |
atlasora-client | 1.0.0 | install.js | Masquerading |
If any of these are in your dependency tree, remove them and treat the affected machine as compromised: rotate credentials, tokens, and SSH keys reachable from it. As a general guard, review and pin brand-new, zero-reputation packages before installing.