Loading story…
Security researchers at Datadog identified 17 npm packages, across 23 releases, that were trojanized to deliver the Vidar infostealer malware to Windows systems. These packages, which masqueraded as legitimate SDKs, Telegram bot helpers, icon libraries, and forks of popular projects, executed the malware through a postinstall script. The campaign, attributed to the threat activity cluster MUT-4831, marks the first public disclosure of Vidar being distributed through npm packages. The malicious packages provided real functionality to avoid suspicion and were available on the npm registry for approximately two weeks before being removed, during which time they were downloaded at least 2,240 times, though many downloads were likely automated.
The threat actors behind the campaign used multiple npm accounts, which have since been banned, to distribute the malware. The incident highlights the ongoing risk of malicious code being uploaded to open source repositories and the challenges faced by developers and CISOs in ensuring the security of dependencies. Datadog's GuardDog tool played a key role in detecting the suspicious packages, and the discovery underscores the need for continuous monitoring and improved security measures within open source ecosystems to prevent similar supply chain attacks.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
Datadog Security researchers discovered the malicious npm packages and documented the campaign as MUT-4831. By the time of reporting, the 17 packages had been removed from npm.
The trojanized packages stayed on npm for about two weeks and were downloaded at least 2,240 times while exposed to developers. This distribution window enabled the Vidar malware campaign to reach victims through the open source supply chain.
Attackers uploaded 17 trojanized npm packages masquerading as legitimate libraries, including Telegram bot helpers, icon libraries, and forks of popular projects. The packages used postinstall scripts to target Windows systems with the Vidar infostealer.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecuritylabs.datadoghq.com
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have uncovered multiple campaigns involving malicious npm packages designed to steal developer credentials and sensitive information from Windows, macOS, and Linux systems. In one operation, ten typosquatted packages impersonated popular libraries such as TypeScript, discord.js, ethers.js, and others, using sophisticated obfuscation, fake CAPTCHA prompts, and postinstall hooks to deploy an information stealer that harvested credentials from system keyrings, browsers, and authentication services. The malware executed in a new terminal window to evade detection and sent stolen data, including IP addresses, to external servers. Another large-scale campaign, dubbed 'PhantomRaven,' involved 126 npm packages and over 86,000 downloads, targeting authentication tokens, CI/CD secrets, and GitHub credentials. These packages leveraged remote dynamic dependencies to fetch and execute payloads during installation, profiling infected devices and exfiltrating secrets for potential supply chain attacks. The attackers employed techniques such as slopsquatting, where AI-generated package recommendations led developers to install non-existent, malicious packages. Some packages impersonated tools from GitLab and Apache, and many remained available on npm at the time of reporting. The campaigns highlight the ongoing risks in the npm ecosystem, with attackers exploiting both user trust and platform weaknesses to compromise developer environments and CI/CD pipelines. Security experts warn that the theft of tokens and credentials could enable further attacks, including the introduction of malicious code into legitimate projects and broader supply chain compromises.
Jun 29, 2026
Security researchers reported multiple **software supply-chain** threats in public package registries where attacker-controlled libraries masquerade as legitimate utilities but install **Windows infostealers**. On NPM, a package named **`duer-js`** (publisher `luizaearlyx`) posed as a console visibility tool and delivered a multi-stage stealer self-identified as **Bada Stealer**; analysis attributed to **JFrog Security Research** described heavy obfuscation, persistence that can survive simple uninstall attempts, and follow-on payload delivery targeting **Discord** by hijacking the desktop client’s startup/injection path to continuously steal data when Discord runs. Separately, Safety’s research team documented **“ExtraZip”**, a campaign of **14 trojanized PyPI packages** impersonating ZIP utilities or mail-sending libraries that deploy a staged infostealer focused on **Telegram Desktop session files**, exfiltrating them via an attacker-controlled **Telegram bot**. The report described **32 layers of obfuscation** and provided an inventory of package names (e.g., `extrazip`, `minizip`, `ziphash`, and multiple `smt*lib` lookalikes) and a timeline of publishing activity across late 2025 through early 2026, indicating sustained, iterative attempts to seed malicious dependencies into developer environments.
Jun 29, 2026
Multiple malicious npm packages have been discovered targeting developers by employing advanced obfuscation techniques and typosquatting to mimic popular legitimate packages such as *TypeScript*, *discord.js*, *ethers.js*, *nodemon*, and *Claude Code*. Security researchers revealed that these packages use up to four layers of obfuscation—including eval wrapping, XOR encryption, URL encoding, and control flow manipulation—to evade static analysis and conceal credential-stealing malware. The attack chain often begins with deceptive tactics, such as displaying fake CAPTCHAs, and proceeds to exfiltrate sensitive information like IP addresses and credentials to attacker-controlled servers. In one notable case, a package impersonating the official Anthropic CLI was found to proxy commands and data back to the threat actor, enabling both credential theft and remote command execution. These incidents highlight the persistent risks posed by weak validation and oversight in the npm ecosystem, allowing threat actors to publish lookalike packages that are difficult to distinguish from legitimate ones. The sophisticated payloads not only target local developer environments but can also compromise CI/CD pipelines, amplifying the potential impact. Security experts emphasize the need for improved package metadata validation and greater vigilance among developers to mitigate the risk of supply chain attacks through open-source dependencies.
Jun 29, 2026