10 NPM TYPOSQUATTED PACKAGES DEPLOY MULTI-STAGE CREDENTIAL HARVESTER

Summary from the TLDR InfoSec newsletter

Socket has identified a campaign using 10 typosquatted npm packages that execute credential-stealing malware when installed. These packages exploit the npm postinstall lifecycle to run code automatically, showing a fake CAPTCHA and realistic installation prompts to deceive developers. The payload employs multiple layers of obfuscation, fingerprints victims by IP, and downloads a 24MB cross-platform information stealer that harvests credentials from system keyrings, browsers, and authentication services on Windows, Linux, and macOS.