Vidar Infostealer Hits npm for the First Time via 17 Typosquatted Packages and Postinstall Scripts

Researchers at Datadog Security Research have uncovered a major supply-chain incident in the npm ecosystem, marking the first known instance of Vidar infostealer distributed via npm packages. The campaign involved 17 malicious packages across 23 releases, published by two recently created accounts, aartje and saliii229911, and active on the registry for about two weeks.

The packages mimicked legitimate utilities such as Telegram bot helpers and icon libraries, with one sample package dubbed custom-tg-bot-plan, described as a “Node.js Telegram Bot API – Custom Fork”; at detection, they had been downloaded at least 2,240 times. A postinstall script was commonly used to execute the attack, with Datadog’s GuardDog static analyser flagging npm-install-script activity.

The two-stage malware chain first downloads an encrypted ZIP from a hardcoded bullethost[.]cloud URL, decrypts it with a hardcoded password, then executes bridle.exe, a known Vidar variant compiled from Go, which harvests browser credentials, cryptocurrency wallets and system files before exfiltrating data and deleting traces.

According to Datadog Security Research, the campaign illustrates how threat actors exploit npm as a reliable initial access vector, and the associated npm accounts have since been banned with the malicious packages removed.