Recently, cybersecurity researchers uncovered a set of 10 malicious npm packages, and through their analysis, they found that attackers had designed these packages to deliver an information stealer targeting Windows, Linux, and macOS systems.
“The malware uses four layers of obfuscation to hide its payload, displays a fake CAPTCHA to appear legitimate, fingerprints victims by IP address, and downloads a 24MB PyInstaller-packaged information stealer that harvests credentials from system keyrings, browsers, and authentication services across Windows, Linux, and macOS,” Socket security researcher Kush Pandya said.
Attackers uploaded the npm packages to the registry on July 4, 2025, and the packages collectively accumulated over 9,900 downloads –
- deezcord.js
- dezcord.js
- dizcordjs
- etherdjs
- ethesjs
- ethetsjs
- nodemonjs
- react-router-dom.js
- typescriptjs
- zustand.js
Moreover, the Attackers carried out a Multi-stage Credential-theft operation through various Typosquatted packages that impersonated popular npm libraries such as TypeScript, Discord.js, Ethers.js, Nodemon, React-router-dom, and zustand.
Malware installed
Once users install one of the packages, the malware serves a fake CAPTCHA prompt and displays authentic-looking output that mimics legitimate package installations, thereby giving the impression that the setup proceeds along expected lines. Meanwhile, the package captures the victim’s IP address, sends it to an external server (“195.133.79[.]43”), and then drops the main malware.
In each package, a postinstall hook automatically triggers the malicious functionality during installation. First, the hook launches a script named “install.js” that detects the victim’s operating system; next, it opens and executes an obfuscated payload (“app.js”) in a new Command Prompt (Windows), GNOME Terminal or x-terminal-emulator (Linux), or Terminal (macOS) window.
“By spawning a new terminal window, the malware runs independently of the npm install process,” Pandya noted. “Developers who glance at their terminal during installation see a new window briefly appear, which the malware immediately clears to avoid suspicion.”
Attackers carefully hide the JavaScript inside “app.js” using four layers of Obfuscation; specifically, they employ techniques such as an XOR cipher with a Dynamically Generated key, in addition, they apply URL-encoding of the payload string, furthermore, they use Hexadecimal and octal Arithmetic to obscure program flow — all of which ultimately aim to resist analysis.
The attack subsequently fetches and executes a comprehensive information stealer (“data_extracter”) from the same server. Following execution, the stealer methodically scans the developer’s Machine, searching for secrets, Authentication tokens, and Credentials, in addition to session cookies Extracted from web browsers, Configuration files, and SSH keys.
The stealer binary also includes Platform-specific implementations to extract Credentials from the system keyring using the keyring npm library. After Harvesting information, the malware Compresses the data into a ZIP archive and Exfiltrates it to the server.
“System keyrings store credentials for critical services including email clients (Outlook, Thunderbird), cloud storage sync tools (Dropbox, Google Drive, OneDrive), VPN connections (Cisco AnyConnect, OpenVPN), password managers, SSH passphrases, database connection strings, and other applications that integrate with the OS credential store,” Socket said.
“By targeting the keyring directly, the malware bypasses application-level security and harvests stored credentials in their decrypted form. These credentials provide immediate access to corporate email, file storage, internal networks, and production databases.”
Source: TheHackerNews
Read more at Impreza News
