Malicious npm Package Execution - @langchain/managed-deepagents-win32-arm64
A package named @langchain/managed-deepagents-win32-arm64 pretends to be an official LangChain prebuilt binary for Windows ARM64. It is not; installing it lets attacker code run on the machine via npm's postinstall step or by invoking the fake binary directly, targeting developers and systems building LangChain-based AI agents.
How the attack works
An attacker publishes a namesquatted npm package that impersonates a legitimate LangChain dependency name. A developer or automated build process installs it, believing it to be a real LangChain artifact, via npm, yarn, or pnpm. During installation, the package's postinstall script executes, or its bundled binary is later invoked, giving the attacker code execution on the host. This is the delivery step of a software supply-chain attack; what the payload does after execution is not covered by this detection.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 3e8a2f1c-9d4b-4a67-8c2e-1f7b6d9a05c3
- Severity
- High
Why it matters
Any machine that installs this package can have attacker-controlled code executed during install or at runtime, exposing developer workstations, CI/CD pipelines, and AI agent deployments to compromise.
What you can do
- →Search your lockfiles and dependency trees for any reference to @langchain/managed-deepagents-win32-arm64 and remove it if found.
- →Pin and verify LangChain and related package names and scopes before installing; watch for lookalike or namesquatted package names.
- →Restrict or review postinstall script execution in your package manager configuration (e.g. npm's ignore-scripts) for unfamiliar or newly added dependencies.
- →Audit CI/CD and build logs for process execution referencing this package name to confirm whether it was actually installed or run, not just searched for.
Known benign look-alikes
- Security scanning or SBOM/dependency-audit tooling (npm audit, Socket.dev CLI, Snyk CLI, OSV-Scanner) that spawns a subprocess referencing the package name while checking a lockfile or dependency tree for this known-bad entry
- Dependency inventory commands such as `npm ls @langchain/managed-deepagents-win32-arm64` or `yarn why @langchain/managed-deepagents-win32-arm64` run by a security team specifically to confirm the package is NOT present in the tree
- Grep/ripgrep sweeps of source trees or lockfiles run during an incident-response audit that pass the package name as a search argument without ever installing or executing it