# Suspicious npm Package - LangChain Namespace Impersonation with Prebuilt Binary

- **Severity:** High
- **Signature ID:** `b47e6d92-1a4c-4f8b-9e3d-5c2a7f691d0e`
- **OWASP:** LLM03 (Supply Chain)

## Summary

Attackers published a malicious npm package named @langchain/managed-deepagents-darwin-x64, imitating the trusted LangChain namespace, and had it execute a bundled prebuilt binary. This detection catches that specific package being executed, not the LangChain ecosystem generally.

## How the attack works

An attacker publishes a package under the @langchain scope using a platform-arch naming pattern (like -darwin-x64) that real LangChain JS packages never use, but that looks legitimate because other ecosystem projects use it for native bindings. A developer or build system installs the package, mistaking it for an official LangChain component. On install or import, the package runs a prebuilt binary shipped inside it, giving the attacker code execution on the host. The rule fires when a process is spawned from or references this binary's package directory.

## Why it matters

A developer machine, CI runner, or server that installs this package executes attacker-controlled native code, giving the attacker a foothold to steal secrets, tamper with builds, or move further into the environment.

## What you can do

- Search all package.json files, lockfiles, and node_modules for any @langchain package with a platform-arch suffix (e.g. -darwin-x64, -linux-arm64) and verify it's not @langchain/managed-deepagents-darwin-x64 or similar.
- Block installation of the package @langchain/managed-deepagents-darwin-x64 via a registry allowlist or npm audit policy.
- If found, remove the package, rotate any credentials accessible from the affected machine, and treat the host as compromised until investigated.
- Pin dependencies to known-good versions from the official @langchain/* packages (core, community, openai, langgraph) and review any new package names before approving them in CI.

## Known benign look-alikes

- Incident response or dependency-audit commands that reference the known-malicious package name to inspect or remove it, e.g. "npm ls @langchain/managed-deepagents-darwin-x64" or "npm uninstall @langchain/managed-deepagents-darwin-x64" run during remediation.
- SBOM generation or static-analysis tooling that enumerates node_modules directory names (e.g. find node_modules/@langchain -maxdepth 1 -iname "*-darwin-x64") as a listing operation without ever invoking the payload inside the matched directory.
- A future legitimate @langchain-scope package that adopts the same platform-arch binary naming convention used elsewhere in the npm ecosystem (e.g. esbuild ships @esbuild/darwin-x64) for native bindings; no such package is published by the LangChain maintainers today.

---
Source: https://www.netzilo.com/threats/npm-langchain-namespace-impersonation