10 NPM Packages That Automatically Run on Install and Steal Credentials

A sophisticated supply chain attack has been uncovered involving ten malicious npm packages that execute automatically on installation and harvest credentials. The packages abuse npm’s postinstall lifecycle hook to run code as soon as developers run npm install, with the threat actor’s package.json triggering an install.js script that detects the victim’s operating system and opens a hidden terminal window.

According to Socket’s Threat Research Team, the malicious packages have remained active on the npm registry since 4 July 2025, accumulating more than 9,900 downloads before removal actions were requested. The attack employs four layers of obfuscation and stages that include a fake CAPTCHA, an IP beacon to 195.133.79[.]43/get_current_ip, and a data_extractor Python application that performs cross‑platform credential harvesting from system keyrings, browser data, tokens, and SSH keys.

The operation targets Windows, Linux, and macOS, exfiltrating data in ZIP archives back to the attackers’ infrastructure. Organisations are urged to audit dependencies, reset credentials, revoke tokens, rotate SSH keys, and review logs for signs of compromise.