New ‘StegaBin’ Campaign Deploys Multi-Stage Credential Stealer via 26 Malicious npm Packages

A new supply-chain attack dubbed StegaBin is targeting JavaScript developers through 26 malicious npm packages that appear to be popular open-source libraries but secretly deploy a multi-stage credential-stealing toolkit and a Remote Access Trojan (RAT).

The campaign is linked to the North Korean-aligned FAMOUS CHOLLIMA threat actor, known from previous “Contagious Interview” operations against cryptocurrency and Web3 developers.

Socket’s AI-based detection flagged 26 npm packages published between 25–26 February 2026, each pushed from throwaway accounts and typosquatting widely used projects such as express, fastify, lodash, uuid, ioredis, jsonwebtoken, mqtt, kafkajs, and others, including several “-lint” themed developer tooling lookalikes.

To appear legitimate and avoid immediate breakage, the malicious packages even declare the genuine library they impersonate as a dependency, so victim projects continue to build while the installer runs in the background.

All 26 packages share a single malicious file located at vendor/scrypt-js/version.js, which is executed via an npm install hook pointing to scripts/test/install.js.

StegaBin Campaign

This loader is heavily obfuscated and implements a text-steganography decoder that pulls three Pastebin pastes containing innocuous-looking computer science essays, then extracts hidden C2 domains from systematically altered characters.

The decoded output is a list of 31 Vercel-hosted domains used as resilient staging infrastructure, of which only one was actively serving payloads during analysis.

From there, the malware fetches platform-specific shell payloads per operating system: curl-based for macOS and Windows, and wget-based for Linux, all routed through the Vercel C2 endpoints.

A token-gated bootstrapper then installs or updates Node.js and Python as needed, downloads an additional parser.js agent plus dependencies, and executes it in the background before wiping traces of the initial script.

The parser.js component functions as a lightweight RAT that connects to a backend server at 103[.]106[.]67[.]63:1244, waiting for commands and orchestrating follow-on payloads.

Malicious npm Packages

By simulating a compromised host, researchers observed the C2 delivering a nine-module infostealer toolkit tailored to developer workstations, including VSCode persistence, keylogging and clipboard theft, browser credential harvesting, TruffleHog-based secret scanning, Git and SSH exfiltration, and a redeployed copy of the StegaBin loader for persistence.

version.js is heavily obfuscated with RC4 string encryption, array rotation, self-defending anti-debug, and control flow flattening.

One module abuses VSCode tasks.json with a 186-space whitespace trick that hides malicious commands calling the Vercel C2 on every folder open, silently re-establishing infection on macOS, Linux, and Windows.

Others implement cross-platform keylogging and clipboard monitoring, browser data theft for major Chromium and Gecko-based browsers, systematic scanning for crypto wallets and seed phrases, and bulk theft of SSH keys, Git tokens, and repositories.

This tooling aligns closely with prior Contagious Interview waves, reinforcing attribution to FAMOUS CHOLLIMA and its focus on cryptocurrency and Web3 developer environments.radar.

Organizations should treat StegaBin as an advanced evolution of DPRK npm supply-chain attacks and tighten dependency hygiene, block suspicious Pastebin and Vercel traffic where possible, and monitor developer endpoints for unusual npm install hooks, VSCode task modifications, and outbound connections to 103[.]106[.]67[.]63 and related infrastructure.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.