Over 15 Malicious npm Packages Exploiting Windows to Deploy Vidar Malware

Datadog Security Research has uncovered a sophisticated supply chain attack targeting the npm ecosystem, involving 17 malicious packages across 23 releases designed to deliver Vidar infostealer malware to Windows systems. The campaign, attributed to a threat actor cluster tracked as MUT-4831, marks the first public disclosure of Vidar being distributed through npm packages.

Researchers found that the packages remained live for approximately two weeks and accumulated at least 2,240 downloads, with the most popular package, react-icon-pkg, downloaded 503 times before removal. The attack chain runs as a three-step process during installation, where a postinstall script downloads an encrypted ZIP archive, decrypts it with hardcoded passwords, and then executes a Windows PE binary named bridle.exe before cleaning up.

Vidar, a v2 infostealer, harvests browser credentials, cookies, cryptocurrency wallets and system files, packaging the data into ZIP archives for exfiltration, and utilises hardcoded Telegram and Steam accounts to dynamically discover active C2 domains. The discovery date was 21 October 2025, and after detection npm banned both attacker accounts and removed all associated packages, underscoring the ongoing risk to open source ecosystems.