npm Registry Flaw Lets Attackers Distribute Malware, Steal Wallets

Key Takeaways

• A sophisticated malware campaign, identified as forge-jsxy and its predecessor forge-jsx, infiltrated the npm registry, distributing a powerful Remote Access Trojan (RAT).
• The malware targets developers, masquerading as a legitimate Node.js integration for Autodesk Forge to steal sensitive data, including cryptocurrency wallet details, keystrokes, and screenshots.
• The threat exhibits advanced persistence mechanisms, surviving package uninstallation and system reboots across Linux, macOS, and Windows environments.
• The campaign involved 88 versions across two packages over 50 days, demonstrating an unusual level of operational discipline for an npm supply chain attack.

Malicious npm Package Delivers Advanced RAT, Targets Crypto Wallets

Cybersecurity researchers have uncovered a persistent and evolving malware campaign leveraging the npm registry to distribute a sophisticated Remote Access Trojan (RAT). Dubbed “forge-jsxy,” the malicious package, along with its precursor “forge-jsx,” was designed to exfiltrate sensitive data, including cryptocurrency wallet information, from unsuspecting developers. The operation stands out for its rapid development cycle and robust persistence mechanisms, which allow the malware to survive even after the infected npm package is removed.

The campaign, meticulously documented by analysts at SafeDep, began with the “forge-jsx” package, first published on April 7, 2026. This initial iteration operated undetected for nearly a month before npm intervened, replacing it with a security placeholder. Undeterred, the attacker swiftly created a new account, “jacksonkaandorp2,” and launched “forge-jsxy” on May 4, 2026, picking up the version numbering precisely where the previous package left off at 1.0.66. Over 22 days, “forge-jsxy” saw 22 new versions released, marking it as one of the most actively developed malware pieces observed on the platform.

Evolution of the forge-jsxy RAT

SafeDep’s analysis, shared with Cyber Security News (CSN), confirmed that the same threat actor was behind both “forge-jsx” and “forge-jsxy,” citing identical command-and-control (C2) configurations, encryption schemes, and session credentials. The malware cleverly mimicked a Node.js integration layer for Autodesk Forge, a legitimate software development kit, lending it an appearance of trustworthiness to developers browsing the registry.

Upon installation, a post-install script stealthily deployed a hidden agent. This agent immediately commenced harvesting a wide array of data, including keystrokes, clipboard contents, environment files, shell history, and desktop screenshots. Notably, the malware was designed to bypass continuous integration (CI) environments, a tactic likely employed to evade detection during automated build processes.

Across both package names, the attacker released a total of 88 versions over 50 days, progressively enhancing the malware’s capabilities to rival commercial-grade spyware. The operator even maintained test coverage, expanding the test suite from 12 to 20 files by the final version—a level of diligence rarely observed in npm supply chain attacks.

The development of “forge-jsxy” unfolded in five distinct phases:

• Phase 1 (v1.0.66 – v1.0.76): Inherited the full feature set of “forge-jsx,” including periodic desktop screenshots exfiltrated to Discord via rotating bot webhooks.
• Phase 2: Introduced a web-based file explorer, granting attackers remote access to victim file systems. By mid-May, WebRTC peer-to-peer data channels were added for faster communication, bypassing the primary WebSocket relay.
• Phase 3 (May 18): A rapid succession of six versions in ten hours introduced a sophisticated cryptocurrency scanning framework. This component scoured the entire file system for wallet files, seed phrases, and private keys. Each discovery was subjected to cryptographic validation before being stored in a hidden vault, designed for persistence across reboots and even package removal.
• Phase 4 (v1.0.91, ending May 26): Added the capability to harvest Chromium browser extension databases from over 21 browsers, including popular ones like Chrome, Edge, Brave, and Opera. This directly targeted wallet extensions such as MetaMask and Phantom.
• Phase 5 (v1.0.91): The final update also integrated an auto-upgrade mechanism, allowing the C2 server to silently push new agent versions to compromised machines on a staggered schedule.

Persistence That Survives Package Removal

A particularly alarming feature of “forge-jsxy” is its ability to establish persistence that renders standard package uninstallation ineffective. Beginning with version 1.0.81, the malware copied its agent files into a hidden directory outside the “node_modules” folder. This means that a typical npm uninstall command would remove the package listing, but the malicious agent would remain fully operational in the background.

The malware establishes persistence differently depending on the operating system:

• Linux: The persistent directory is located at ~/.local/share/cfgmgr/.forge-jsxy/. A systemd unit ensures the agent restarts after every reboot.
• macOS: The agent resides in ~/Library/Application Support/CfgMgr/data/.forge-jsxy/, with persistence achieved via a LaunchAgent entry.
• Windows: The files are stored in %LOCALAPPDATA%CfgMgrdata.forge-jsxy, and persistence is maintained through a Task Scheduler entry and a registry run key.

SafeDep advises that any developer who installed any version of these packages should consider all credentials and wallet keys on that machine compromised.

What You Should Do

• Immediate System Cleanup: Manually delete the durable agent directory and remove the associated startup service. SafeDep provides specific paths for Linux (~/.local/share/cfgmgr/.forge-jsxy/, ~/.config/systemd/user/forge-js-worker.service), macOS (~/Library/Application Support/CfgMgr/data/.forge-jsxy/, ~/Library/LaunchAgents/com.forgejs.worker.plist), and Windows (%LOCALAPPDATA%CfgMgrdata.forge-jsxy, Task Scheduler entry “ForgeJSWorker” and registry run key “HKCU…RunForgeJSWorker”).
• Credential Rotation: Assume all credentials (passwords, API keys, SSH keys, tokens) on the compromised machine are stolen. Change them immediately, especially for critical services and development platforms.
• Cryptocurrency Wallet Security: If you use browser-based crypto wallets on the affected system, transfer all funds to new wallets generated on a demonstrably clean and secure machine. Do not reuse any seed phrases or private keys from the compromised system.
• Monitor for Re-emergence: Given the attacker’s swift re-launch after the initial takedown of “forge-jsx,” remain vigilant for new packages with similar functionality under different names. Implement robust supply chain security practices.
• Review and Enhance Supply Chain Security: Implement automated tools for scanning open-source dependencies for known vulnerabilities and malicious code. Adopt policies for vetting new packages before integration into production environments.
• Educate Developers: Ensure development teams are aware of the risks of malicious packages and best practices for verifying the authenticity and integrity of third-party libraries.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.