Cybersecurity researchers have discovered a set of 10 malicious npm packages that are designed to deliver an information stealer targeting Windows, Linux, and macOS systems.
"The malware uses four layers of obfuscation to hide its payload, displays a fake CAPTCHA to appear legitimate, fingerprints victims by IP address, and downloads a 24MB PyInstaller-packaged information stealer that harvests credentials from system keyrings, browsers, and authentication services across Windows, Linux, and macOS," Socket security researcher Kush Pandya said.
The npm packages were uploaded to the registry on July 4, 2025, and accumulated over 9,900 downloads collectively -
- deezcord.js
- dezcord.js
- dizcordjs
- etherdjs
- ethesjs
- ethetsjs
- nodemonjs
- react-router-dom.js
- typescriptjs
- zustand.js
The multi-stage credential theft operation manifested in the form of various typosquatted packages impersonating popular npm libraries such as TypeScript, discord.js, ethers.js, nodemon, react-router-dom, and zustand.
Once installed, the malware serves a fake CAPTCHA prompt and displays authentic-looking output that mimics legitimate package installations to give the impression that the setup process is proceeding along expected lines. However, in the background, the package captures the victim's IP address, sends it to an external server ("195.133.79[.]43"), and then proceeds to drop the main malware.
In each package, the malicious functionality is automatically triggered upon installation by means of a postinstall hook, launching a script named "install.js" that detects the victim's operating system and launches an obfuscated payload ("app.js") in a new Command Prompt (Windows), GNOME Terminal or x-terminal-emulator (Linux), or Terminal (macOS) window.
"By spawning a new terminal window, the malware runs independently of the npm install process," Pandya noted. "Developers who glance at their terminal during installation see a new window briefly appear, which the malware immediately clears to avoid suspicion."
The JavaScript contained within "app.js" is hidden through four layers of obfuscation -- such as XOR cipher with a dynamically generated key, URL-encoding of the payload string, and using hexadecimal and octal arithmetic to obscure program flow -- that are designed to resist analysis.
The end goal of the attack is to fetch and execute a comprehensive information stealer ("data_extracter") from the same server that's equipped to thoroughly scan the developer's machine for secrets, authentication tokens, credentials, and session cookies from web browsers, configuration files, and SSH keys.
The stealer binary also incorporates platform-specific implementations to extract credentials from the system keyring using the keyring npm library. The harvested information is compressed into a ZIP archive and exfiltrated to the server.
"System keyrings store credentials for critical services including email clients (Outlook, Thunderbird), cloud storage sync tools (Dropbox, Google Drive, OneDrive), VPN connections (Cisco AnyConnect, OpenVPN), password managers, SSH passphrases, database connection strings, and other applications that integrate with the OS credential store," Socket said.
"By targeting the keyring directly, the malware bypasses application-level security and harvests stored credentials in their decrypted form. These credentials provide immediate access to corporate email, file storage, internal networks, and production databases."
