Malicious npm Packages Distribute PyInstaller Infostealer via Typosquatting and Fake CAPTCHA

Ten malicious packages were discovered on the npm registry, masquerading as popular JavaScript libraries through typosquatting techniques. These packages, which included names like typescriptjs, deezcord.js, and react-router-dom.js, were designed to trick developers into downloading them by mimicking legitimate projects. Upon installation, a postinstall script executed a heavily obfuscated loader that displayed a fake CAPTCHA in the terminal to appear legitimate, then downloaded and ran a 24MB infostealer built with PyInstaller. This malware targeted Windows, Linux, and macOS systems, stealing credentials from system keyrings, browsers, and authentication services. The campaign went undetected for an extended period, resulting in nearly 10,000 downloads before being reported to npm, with the malicious packages still available at the time of reporting.

The infostealer's deployment leveraged multiple layers of obfuscation, including self-decoding wrappers, XOR decryption, and control-flow obfuscation, to evade static analysis and detection. The attack highlights the ongoing risks posed by supply chain threats in open-source ecosystems, particularly through typosquatting and social engineering tactics. Security researchers emphasized the importance of vigilance when installing npm packages and recommended enhanced scrutiny of package names and sources to mitigate the risk of inadvertently installing malicious software.