October 2, 2026
- Malicious npm package
dotenv-asyncexecutes a concealed downloader when imported. Version 1.0.0 poses as an environment-configuration utility but hides Windows payload logic in JPEG metadata. The next stage is an unsigned NSIS installer that deploys an obfuscated Electron infostealer targeting browser passwords, cookies, and payment data. Nextron Research · Threat Activity & Supply Chain
in OpenAI Disrupts a Coordinated Model-Reasoning Extraction Campaign