// publisher campaign · npm

58bits

All caught packages published by the 58bits account on npm, plus the author + maintainer info the registry currently exposes. Use this view to pivot: shared emails / names across packages are strong evidence of a single attacker behind multiple throwaway handles.

npmjs.com publisher

packages

distinct names

catch events

versions × names

blast

—

combined weekly downloads

active span

2026-05-20 → 2026-05-20

first → last catch

// publisher osint

Account-level signals. Activity span tells you how long this handle has been around (fresh = throwaway-prone). Email domains separate single-use webmail from real org addresses. Cross-ecosystem handles + GitHub links are the strongest attribution pivot — same name on multiple registries usually means same operator.

activity on npm

packages on registry: 22
first publish: 2025-08-15
latest publish: 2026-07-17
active span: 336d

same handle on other registries

npm /~58bits: exists ↗
pypi /user/58bits: exists ↗
github.com/58bits: exists ↗

email domains

infonomic.io×2
gmail.com×1webmail

// exfil path

what is read → where it ships

steals

● Chromium logins

sends to

(no destination string extracted — payload may be dynamic / obfuscated)

// pattern footprint

Static-analysis flags that fired across the campaign, with how many packages each touched. Use as the "what kind of stealer is this" answer.

// full activity on npm

Every package this account currently has on the registry, newest first. ● caught by our pipeline · ○ not yet flagged.1/22 caught.

@byline/ui@ 4.2.0
Byline CMS UI package
2026-07-17
@byline/storage-s3@ 4.2.0
Byline CMS S3-compatible storage provider (AWS S3, Cloudflare R2, MinIO, etc.)
2026-07-17
@byline/storage-local@ 4.2.0
Byline CMS local filesystem storage provider
2026-07-17
@byline/search-postgres

// packages in this campaign

1 distinct · newest first

↳ author:maintainers: daveamayombo <david@infonomic.io>, infonomic2 <anthony@infonomic.io>, 58bits <anthony.bouch@gmail.com>↗ registry

// pattern footprint

// packages in this campaign

@byline/host-tanstack-start4 versions·2.2.2→2.2.6