npm Typosquat Campaign: 10 Malicious Packages Deliver PyInstaller Infostealer via Fake CAPTCHA

The Socket Threat Research Team has identified a significant supply chain attack within the npm ecosystem, involving 10 malicious packages that masquerade as legitimate developer tools. These packages, published on July 4, 2025, utilized typosquatting techniques to deceive developers, amassing nearly 10,000 downloads before their removal. The attacker, known as 'andrew_r1', uploaded fake versions of popular open-source libraries, which executed harmful postinstall scripts upon installation.

The malware employs multiple layers of obfuscation and displays a fake CAPTCHA to extract sensitive information, including credentials from system keyrings and web browsers. The stolen data is packaged and sent to an attacker-controlled server, allowing for potential long-term unauthorized access.