Your Kubernetes Package Is Now an AI Piracy Node: The kube-health-tools GPT-Proxy Supply Chain Attack

TL;DR: Two packages — kube-health-tools (npm) and kube-node-health (PyPI) — masquerade as Kubernetes health utilities while silently deploying a full LLM proxy service that reroutes AI API traffic through compromised developer and CI/CD machines, turning victims into unwitting relay nodes in a commercial LLM reselling operation. This is a category-new supply chain payload: not credential theft, not ransomware — monetized infrastructure hijacking at machine speed.

---

Background

The week of April 21–26, 2026 will be remembered as one of the most concentrated periods of open-source supply chain aggression on record. Three coordinated campaigns hit npm, PyPI, and Docker Hub in under 48 hours: TeamPCP's CanisterSprawl worm propagating through Namastex Labs packages, a compromised Checkmarx KICS Docker image, and a xinference credential stealer. But buried beneath that noise — and first spotted by Aikido Security researchers on April 22 — was something analytically distinct: kube-health-tools and kube-node-health.

Unlike the credential-stealer campaigns that dominated headlines, these two packages weren't designed to exfiltrate tokens and disappear. They were designed to stay, hide, and generate revenue for the attacker by routing LLM API calls through victim infrastructure. The payload is a fully operational LLM proxy service — a commercial AI reselling node, running silently on your developer machine or CI/CD runner.

This isn't the supply chain attack model we've been training defenders to recognize. It's a new one.

---

Technical Analysis

Stage 1: The Legitimate-Looking Droppers

Both packages are crafted for plausibility. kube-health-tools on npm and kube-node-health on PyPI share Kubernetes-adjacent naming that would raise no flags in a typical package.json audit or requirements.txt scan. Neither carries human-readable malicious code at the surface layer — the payload is delivered through compiled native binaries that execute at import or require() time.

npm dropper: addon.node — a Node.js native addon

PyPI dropper: __init___cpython-311-x86_64-linux-gnu.so — a Cython-compiled Python extension

Both execute the moment the package is loaded — no explicit function call required. The .so fires on Python import; the .node fires on require(). Zero user interaction.

Stage 2: Two-Phase Remote Payload

Each dropper resolves an XOR-obfuscated URL to download a second-stage binary from a GitHub release:

• PyPI path: github[.]com/gibunxi4201/kube-node-diag/releases/download/v2[.]0/kube-diag-linux-amd64-packed
• npm path: same repository, kube-diag-full-linux-amd64-packed (the "full" variant carries additional LLM proxy capability)

Both binaries are written to /tmp/.kh, marked executable (chmod +x), and launched immediately. The hidden dot-prefix in /tmp/ is a classic persistence camouflage technique — it won't appear in a basic ls /tmp listing.

The droppers also embed XOR-encrypted configuration blobs that are piped directly to the stage 2 binary via stdin on launch, so the config never touches disk as plaintext.

Stage 3: The LLM Proxy Runtime

The decrypted runtime configuration reveals the true purpose:

{
  "server": "https://sync[.]geeker[.]indevs[.]in",
  "auth": "skywork:e5c2b988f369d9e51f30985eb8c1c5ae",
  "tunnels": [
    "R:4444:127.0.0.1:0",
    "R:4446:127.0.0.1:22",
    "R:4445:127.0.0.1:8200"
  ],
  "shell": {
    "enabled": true,
    "password": "123qweASD",
    "auth_keys": []
  },
  "disguise": {
    "process_name": "node-health-check",
    "argv": "--mode=daemon"
  },
  "keepalive": "25s",
  "max_retry_interval": "30s"
}

Breaking this down:

C2 server: sync[.]geeker[.]indevs[.]in — authenticated with a hardcoded credential (skywork:<md5_hash>), suggesting a centrally managed relay cluster, not a one-off operation.

Three reverse tunnels:

• Port 4444: General proxy/relay (LLM API traffic forwarding)
• Port 4446: SSH port 22 (full shell access to the victim machine)
• Port 4445: Port 8200 (commonly Vault/Consul — Kubernetes secret management)

Shell access: The payload enables an interactive reverse shell with a hardcoded password (123qweASD). This is not a passive relay — it's a fully interactive backdoor.

Process disguise: The implant masquerades as node-health-check --mode=daemon in process listings. On a Kubernetes node where dozens of health-check daemons run legitimately, this achieves near-perfect camouflage against a naive ps aux or container runtime audit.

The LLM Monetization Model

The "LLM proxy" component is operationally tied to Chinese commercial AI reselling platforms — services that sell API access to OpenAI, Claude, and domestic Chinese models (Qwen, DeepSeek, Baidu ERNIE) at below-retail prices. The business model: aggregate compromised infrastructure, route paying customers' LLM queries through victim machines, and pocket the margin.

This means the attacker's cost structure is zero — every LLM API call processed earns them revenue while the victim pays for compute, bandwidth, and potential API key exposure. The SOCKS5 proxy and SFTP server components in the Go-based binary (referenced in the broader campaign reporting) further enable the operators to use victim machines as general-purpose anonymization nodes.

A Kubernetes cluster operating as an LLM relay is particularly attractive: high network throughput, stable uptime, often cloud-provisioned with unrestricted egress, and monitored primarily for application-layer health rather than anomalous outbound connections.

---

The Ecosystem Context: April 2026 Supply Chain Surge

The kube-health-tools campaign does not exist in isolation. April 21–23, 2026 saw three simultaneous campaigns across three package registries:

Campaign 1 — Checkmarx KICS (Docker Hub): TeamPCP compromised official Docker images for the open-source Checkmarx KICS security scanner. The payload harvested GitHub tokens, AWS/Azure/GCP credentials, npm configs, and SSH keys. This was TeamPCP's second Checkmarx attack in two months — a deliberate pattern of re-targeting trusted security tooling to weaponize the defender's own stack.

Campaign 2 — CanisterSprawl (npm/PyPI): Malicious versions of pgserve and a set of Namastex Labs AI-agent npm packages deployed a self-propagating credential worm. On finding an npm publish token, the worm identifies all packages the victim can publish, injects itself, bumps the patch version, and republishes — recursively infecting the victim's entire package portfolio. If a PyPI token is also present, the worm jumps ecosystems entirely using a .pth-based payload. C2 infrastructure uses Internet Computer Protocol (ICP) canisters — a decentralized, censorship-resistant channel that cannot be taken down by requesting a domain seizure or CDN block.

Campaign 3 — xinference (PyPI): Three consecutive releases of the popular xinference AI inference framework carried a credential stealer attributed to TeamPCP based on injection pattern and multi-version cadence, though the lack of encryption in this payload (plain tar.gz to C2) has led some researchers to consider a copycat.

The kube-health-tools/kube-node-health campaign represents a fourth simultaneous track — one with a distinct objective (infrastructure monetization rather than credential exfiltration) and potentially a separate threat actor.

---

Attribution & Threat Actor Assessment

Aikido Security identifies infrastructure overlaps suggesting Chinese-origin operations, based on:

• C2 domain (sync[.]geeker[.]indevs[.]in) resolving to Alibaba Cloud IP space historically associated with Chinese LLM reselling operations
• The skywork authentication prefix referencing Skywork, a Chinese AI lab known for open-weight LLMs
• GitHub repository (gibunxi4201/kube-node-diag) created shortly before the campaign with no legitimate commit history
• The LLM proxy's upstream routing aligning with commercial API-reselling platforms that explicitly serve Chinese AI API consumers operating under export restrictions

Confidence: MEDIUM. The infrastructure signals are consistent but not conclusive. We assess this as a financially motivated campaign with Chinese infrastructure nexus rather than a state-directed operation. The business model (LLM API arbitrage) is commercially rational and requires no nation-state backing.

---

Indicators of Compromise (IOCs)

| Type | Value | Notes |

|------|-------|-------|

| npm package | kube-health-tools (all versions) | Malicious — remove immediately |

| PyPI package | kube-node-health (all versions) | Malicious — remove immediately |

| GitHub repo | github[.]com/gibunxi4201/kube-node-diag | Stage 2 payload hosting |

| Binary path | /tmp/.kh | Hidden stage 2 binary on compromised hosts |

| Process name | node-health-check --mode=daemon | Disguised implant process |

| C2 domain | sync[.]geeker[.]indevs[.]in | Hardcoded C2 server |

| C2 auth | skywork:e5c2b988f369d9e51f30985eb8c1c5ae | Hardcoded credential |

| Shell port (remote) | 4446 → victim :22 | Reverse SSH tunnel to C2 |

| LLM proxy port (remote) | 4444 → victim :0 | Reverse proxy for LLM traffic |

| Vault port (remote) | 4445 → victim :8200 | Kubernetes secret exfil path |

| Network | Egress to Alibaba Cloud IP range | Check egress logs for sync.geeker.indevs.in |

| File extension | __init___cpython-311-x86_64-linux-gnu.so | Cython-compiled dropper in PyPI package |

| File extension | addon.node | Node.js native addon dropper in npm package |

---

Lyrie Take

This is the supply chain attack threat model evolving in real time, and most defender tooling isn't calibrated for it.

The industry has spent three years training defenders to look for credential-stealing postinstall hooks — exfiltration payloads that grab tokens and phone home once. Every SAST tool, every SCA scanner, every npm audit configuration is tuned for that pattern.

The kube-health-tools campaign breaks that model entirely. There's no credential exfiltration event to detect. No spike in outbound DNS to a suspicious domain at install time. The payload establishes a persistent reverse tunnel that keeps a low-and-slow connection alive to a C2 that looks, at the network layer, like a legitimate TLS connection to a cloud infrastructure endpoint. The revenue generation (LLM API routing) happens asynchronously and generates no anomalous traffic signatures inside the victim's environment — all the "suspicious" traffic is on the attacker's side of the tunnel.

More concerning: the implicit attack surface here is the AI development stack itself. Packages named kube-health-tools and kube-node-health are not targeting random developers — they're targeting teams building Kubernetes-native AI workloads. These environments almost certainly have LLM API keys, cloud credentials, Vault tokens, and CI/CD secrets in scope. The LLM proxy is both the attacker's revenue model and their recon tool.

Lyrie's autonomous detection approach is architecturally suited to this class of attack because we instrument the runtime behavior of processes, not just the static signatures of packages. A process masquerading as node-health-check that opens three reverse tunnels to a cloud endpoint at startup is behaviorally anomalous regardless of what the package's package.json says. Machine-speed process graph analysis catches this in seconds. Traditional SCA finds it on the next scheduled scan — after the tunnel has been open for days.

---

Defender Playbook

Immediate (if you installed kube-health-tools or kube-node-health at any version):

1. Kill the implant: Search all systems for /tmp/.kh and any process matching node-health-check --mode=daemon. Kill and delete.

2. Audit network egress: Pull egress logs for connections to sync.geeker.indevs.in and any Alibaba Cloud IPs (AS37963, AS45102). Look for persistent TLS connections on non-standard ports (4444, 4445, 4446).

3. Rotate all secrets accessible from the compromised environment: Kubernetes secrets, Vault tokens, cloud IAM credentials, LLM API keys (OpenAI, Anthropic, etc.), and CI/CD tokens. Assume full compromise.

4. Audit LLM API usage: Pull API usage logs from OpenAI/Anthropic/etc. for anomalous consumption spikes in the period the package was installed. Unexpected usage = your keys are live in the relay.

5. Inspect SSH authorized_keys and audit logs: The reverse tunnel on port 4446 (SSH) may have been used for interactive access. Check ~/.ssh/authorized_keys, auth.log, and last login timestamps.

Ongoing hardening:

6. Enforce native binary blocking in package installs: Use npm install --ignore-scripts (disables postinstall) and audit any package shipping .node native addons or Cython .so files not from known-trusted origins.

7. Network-layer runtime monitoring: Alert on processes establishing outbound connections on unusual ports. Kubernetes environments should have network policies (NetworkPolicy CRDs) explicitly restricting egress from build/test namespaces.

8. Process lineage analysis: Any daemon spawned by a package postinstall or import hook that is not listed in your application's known process inventory should trigger an alert.

9. Implement dependency pinning with hash verification: npm ci with a committed package-lock.json and integrity hash validation catches version-bump attacks. For PyPI, pin exact versions with pip-compile and hash-check mode.

10. Audit /tmp for hidden files: Add /tmp/.* scanning to your endpoint security policy. Legitimate software rarely needs hidden executables in /tmp/.

Detection rules (SIEM/EDR):

# Process name spoofing + reverse tunnel pattern
ALERT IF:
  process.name = "node-health-check" AND
  process.args CONTAINS "--mode=daemon" AND
  net.connection.direction = "outbound" AND
  net.connection.dest_port IN (4444, 4445, 4446)

# Hidden binary execution from /tmp
ALERT IF:
  file.path MATCHES "/tmp/\.[a-z]{1,4}$" AND
  file.is_executable = true AND
  process.parent.name IN ("node", "python", "python3")

# Outbound connection to C2
ALERT IF:
  net.connection.dest_hostname = "sync.geeker.indevs.in"

---

Sources

1. Aikido Security — "GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays" (April 22, 2026): https://www.aikido.dev/blog/gpt-proxy-backdoor-npm-pypi-chinese-llm-relay

2. BleepingComputer — "New npm supply-chain attack self-spreads to steal auth tokens" (April 23, 2026): https://www.bleepingcomputer.com/news/security/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens/

3. GitGuardian — "No Off Season: Three Supply Chain Campaigns Hit npm, PyPI, and Docker Hub in 48 Hours" (April 23, 2026): https://blog.gitguardian.com/three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours/

4. The Register — "Another npm supply chain worm hits dev environments" (April 22, 2026): https://www.theregister.com/2026/04/22/another_npm_supply_chain_attack/

5. The Hacker News — "Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens" (April 25, 2026): https://thehackernews.com/2026/04/self-propagating-supply-chain-worm.html

---

Lyrie.ai Cyber Research Division — Senior Analyst Desk