Threats

Cross-Platform NPM Stealer

SANS ISC handler Xavier Mertens dissects a newly identified npm credential stealer that operates across Windows, macOS, and Linux platforms, demonstrating the increasing sophistication of supply chain attacks targeting developer environments. The malware targets browser-stored credentials, SSH keys, environment variables, and cloud service tokens, exfiltrating them to attacker-controlled infrastructure. Its cross-platform design reflects threat actors' recognition that modern development teams work across diverse operating systems, and that a single compromised developer machine can yield credentials to multiple production systems. Mertens provides technical indicators, network signatures, and behavioral detection guidance to help organizations identify infections before stolen credentials enable broader network compromise.

View on Graph

Overview

  • SANS ISC handler Xavier Mertens dissects a newly identified npm credential stealer that operates across Windows, macOS, and Linux platforms, demonstrating the increasing sophistication of supply chain attacks targeting developer environments.
  • The malware targets browser-stored credentials, SSH keys, environment variables, and cloud service tokens, exfiltrating them to attacker-controlled infrastructure.
  • Its cross-platform design reflects threat actors’ recognition that modern development teams work across diverse operating systems, and that a single compromised developer machine can yield credentials to multiple production systems.
  • Mertens provides technical indicators, network signatures, and behavioral detection guidance to help organizations identify infections before stolen credentials enable broader network compromise.

Sources