--- title: GPT-Proxy Backdoor in npm and PyPI turns Servers into... description: Two malicious packages — kube-health-tools (npm) and kube-node-health (PyPI) — were discovered targeting Kubernetes environments. Both use Kubernetes-themed... canonical: https://daily.dev/posts/gpt-proxy-backdoor-in-npm-and-pypi-turns-servers-into-chinese-llm-relays-9yh9mksmp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays | daily.dev og:description: Two malicious packages — kube-health-tools (npm) and kube-node-health (PyPI) — were discovered targeting Kubernetes environments. Both use Kubernetes-themed... og:url: https://daily.dev/posts/gpt-proxy-backdoor-in-npm-and-pypi-turns-servers-into-chinese-llm-relays-9yh9mksmp og:image: https://api.daily.dev/og/posts/9YH9mkSmp.png og:image:alt: GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays **[Aikido Security](https://daily.dev/sources/aikido-security)** · 8 min read · 0 upvotes · 0 comments ## Summary Two malicious packages — kube-health-tools (npm) and kube-node-health (PyPI) — were discovered targeting Kubernetes environments. Both use Kubernetes-themed names to appear legitimate while silently installing a multi-stage backdoor. Stage 1 is a compiled native binary (a Cython .so or Node.js .node addon) that downloads a Go-based stage 2 RAT from GitHub, then erases all traces of itself within two seconds. The stage 2 binary establishes reverse tunnels via Chisel over WebSocket to a C2 server, exposing SSH, HashiCorp Vault, and an OpenAI-compatible LLM proxy. The LLM proxy routes AI requests through Chinese intermediary aggregators (shubiaobiao, cloudsway, volengine, etc.), effectively turning compromised servers into relay nodes in a gray-market AI reselling operation. The attack is linked to the broader Chinese proxy ecosystem driven by Great Firewall restrictions. Beyond cheap AI access, such routers pose serious risks: malicious operators can inject tool calls into coding agent responses or silently exfiltrate API keys and credentials. IOCs including package names, file hashes, C2 domains, and process indicators are provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#cyber](https://daily.dev/tags/cyber), [#kubernetes](https://daily.dev/tags/kubernetes), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/gpt-proxy-backdoor-in-npm-and-pypi-turns-servers-into-chinese-llm-relays-9yh9mksmp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays","url":"https://daily.dev/posts/gpt-proxy-backdoor-in-npm-and-pypi-turns-servers-into-chinese-llm-relays-9yh9mksmp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/gpt-proxy-backdoor-in-npm-and-pypi-turns-servers-into-chinese-llm-relays-9yh9mksmp"},"datePublished":"2026-04-22T08:57:26.509Z","dateModified":"2026-08-24T06:57:23.892Z","description":"Two malicious packages — kube-health-tools (npm) and kube-node-health (PyPI) — were discovered targeting Kubernetes environments. Both use Kubernetes-themed...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4451d81ee3bf58000790a4d0d8110eec?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4451d81ee3bf58000790a4d0d8110eec?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/gpt-proxy-backdoor-in-npm-and-pypi-turns-servers-into-chinese-llm-relays-9yh9mksmp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,kubernetes,malware,npm","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays"}]} ```