10 npm Packages Caught Stealing Developer Credentials on Windows, macOS, and Linux

Cybersecurity researchers have identified a set of 10 malicious npm packages designed to deliver an information stealer across Windows, Linux and macOS. The packages—deezcord.js, dezcord.js, dizcordjs, etherdjs, ethesjs, ethetsjs, nodemonjs, react-router-dom.js, typescriptjs and zustand.js—were uploaded to the registry on 4 July 2025 and have accumulated over 9,900 downloads collectively.

The operation uses four layers of obfuscation and serves a fake CAPTCHA to appear legitimate, then downloads a 24MB PyInstaller-packaged information stealer that harvests credentials from system keyrings, browsers and authentication services. According to Socket security researcher Kush Pandya, the malware is multi-stage and triggers via a postinstall hook, creating a hidden payload called app.js that runs in a new terminal window to evade immediate detection.

The stealer, named data_extractor, targets credential stores across Windows, Linux and macOS, compresses the harvested data into a ZIP archive, and exfiltrates it to a server at 195.133.79[.]43.