136 NPM Packages Delivering Infostealers Downloaded 100,000 Times

136 NPM packages delivering infostealers have been identified, with the collective downloads totalling about 100,000 over the past four months, SecurityWeek reports. The campaigns comprise two operations active since July and August, respectively, and a total of 136 packages were uncovered. According to Koi Security, the July campaign involved 10 packages that amassed more than 9,900 downloads, while the August campaign involved 126 packages, with roughly 80 still active and over 86,000 downloads in total.

The malware uses NPM’s postinstall hook to run a script that identifies the victim’s OS, displays a fake CAPTCHA, and then downloads and executes a PyInstaller-packaged Python payload that harvests system information and credentials from sources such as keyrings, browser cookies, authentication tokens, and SSH private keys. The information stealer transmits data to an attacker-controlled server, with exfiltration occurring via HTTP GET requests, HTTP POST requests, and WebSocket connections.

The campaigns rely on typosquatting to entice developers, and the report emphasises the need to treat installs and builds as untrusted execution and to implement controls that cover downstream runtime behaviour.