Vidar Infostealer Malware Hits npm Ecosystem

Datadog Security Research discovered a sophisticated supply chain attack targeting the npm ecosystem. The campaign, attributed to threat actor cluster MUT-4831, involved 17 malicious packages designed to deliver the Vidar infostealer malware to Windows systems. These packages masqueraded as legitimate software development kits and libraries, executing destructive payloads through postinstall scripts. Despite being live for approximately two weeks, the packages were downloaded at least 2,240 times before removal. The Vidar malware, a Go-compiled variant, aggressively harvests sensitive data and uses hardcoded Telegram and Steam accounts for command-and-control infrastructure. The campaign highlights the persistent vulnerability of open-source package ecosystems to supply chain exploitation.