Loading story…
Security researchers reported multiple software supply-chain threats in public package registries where attacker-controlled libraries masquerade as legitimate utilities but install Windows infostealers. On NPM, a package named duer-js (publisher luizaearlyx) posed as a console visibility tool and delivered a multi-stage stealer self-identified as Bada Stealer; analysis attributed to JFrog Security Research described heavy obfuscation, persistence that can survive simple uninstall attempts, and follow-on payload delivery targeting Discord by hijacking the desktop client’s startup/injection path to continuously steal data when Discord runs.
Separately, Safety’s research team documented “ExtraZip”, a campaign of 14 trojanized PyPI packages impersonating ZIP utilities or mail-sending libraries that deploy a staged infostealer focused on Telegram Desktop session files, exfiltrating them via an attacker-controlled Telegram bot. The report described 32 layers of obfuscation and provided an inventory of package names (e.g., extrazip, minizip, ziphash, and multiple smt*lib lookalikes) and a timeline of publishing activity across late 2025 through early 2026, indicating sustained, iterative attempts to seed malicious dependencies into developer environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
JFrog Security Research's analysis of the 'duer-js' package was publicly reported, highlighting that uninstalling the NPM package alone would not remove the threat because it established persistence through Discord. The report also described exfiltration via a Discord webhook and a backup Gofile channel.
A malicious NPM package named 'duer-js,' published by the user 'luizaearlyx,' was made available while posing as a console visibility tool. When installed, it deployed a multi-stage stealer that persisted through Discord startup injection and stole data from Discord, browsers, crypto wallets, Telegram, and Steam.
Safety published research on the ExtraZip campaign, detailing 14 trojanized PyPI packages, a 32-layer obfuscation chain, Telegram-focused data theft, and related indicators of compromise such as package names, hashes, C2 endpoints, and Telegram bot details.
The ExtraZip operation continued to publish trojanized Python packages over subsequent waves, ultimately totaling 14 malicious packages. On Windows, the packages fetched additional payloads, used heavily obfuscated multi-stage execution, and exfiltrated Telegram Desktop session data via the Telegram Bot API.
The ExtraZip supply-chain campaign started releasing malicious PyPI packages masquerading as ZIP utilities and email-related libraries in multiple waves. Safety said the activity began in late November 2025 and used several author aliases, with necr.email@example.com tied to most packages.
3 references tracked. Mallory keeps watching after this page renders.
npmjs.com
Open sourcecybersecuritynews.com
Open sourcegetsafety.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026
Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake *Resident Evil 9* mod from GitHub triggered a `curl | cmd` chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to **PureRAT**, which persisted through the `Run` key and communicated over authenticated WebSockets with `agent.sm-veo.com`. Another Windows campaign, dubbed **Operation TURB00**, used a Go loader and decoy console program to launch **Vidar** in memory, steal browser and application data, and install persistence through `agt.dll` and the `CadenceOptimizer` service running under `svchost` as `LocalSystem`. On macOS, analysts reversed a fully undetected **Atomic macOS Stealer (AMOS)** sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to `95.164.53.3/contact`. In the software supply chain, a malicious PyPI package, `nhmpy 2.4.7`, masqueraded as NumPy while using a `.pth` file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named **REDSUN** showed how attackers could turn standard-user access into `NT AUTHORITY\SYSTEM` by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.
Jul 12, 2026
Ten malicious packages were discovered on the npm registry, masquerading as popular JavaScript libraries through typosquatting techniques. These packages, which included names like `typescriptjs`, `deezcord.js`, and `react-router-dom.js`, were designed to trick developers into downloading them by mimicking legitimate projects. Upon installation, a postinstall script executed a heavily obfuscated loader that displayed a fake CAPTCHA in the terminal to appear legitimate, then downloaded and ran a 24MB infostealer built with PyInstaller. This malware targeted Windows, Linux, and macOS systems, stealing credentials from system keyrings, browsers, and authentication services. The campaign went undetected for an extended period, resulting in nearly 10,000 downloads before being reported to npm, with the malicious packages still available at the time of reporting. The infostealer's deployment leveraged multiple layers of obfuscation, including self-decoding wrappers, XOR decryption, and control-flow obfuscation, to evade static analysis and detection. The attack highlights the ongoing risks posed by supply chain threats in open-source ecosystems, particularly through typosquatting and social engineering tactics. Security researchers emphasized the importance of vigilance when installing npm packages and recommended enhanced scrutiny of package names and sources to mitigate the risk of inadvertently installing malicious software.
Jun 29, 2026