Stardrop NPM Campaign Uses More Than 200 Packages to Steal Cloud and AI Credentials
Summary
Researchers report more than 200 NPM packages posing as an AI coding agent. Their postinstall scripts deploy platform-specific infostealers that harvest credentials; packages removed from NPM may remain available through some mirrors.
Key points
- OpenSourceMalware says it identified more than 200 malicious NPM packages, averaging over 40 new packages per day since April 9.
- Packages impersonate an AI coding agent and use optional dependencies to distribute binaries for Linux, macOS, and Windows.
- An NPM postinstall script detects the system, deploys the appropriate binary, and creates a command-line symlink.
- Analyzed payloads steal credentials, including cloud and AI service keys; the report says they harvest files such as ~/.local/share/stardrop/auth.json.
- The researchers report that NPM removed packages quickly, but some remained installable from Chinese and European NPM mirrors.
- The report lists stardrop[.]dev and p9ia72yajp[.]us-east-1[.]awsapprunner[.]com as network indicators and describes a Windows payload downloading a DLL.
Article Details
- Attack Vectors
- More than 200 malicious packages were published to NPM, masquerading as a new AI coding agent named Stardrop.
- Package installation triggers a postinstall.mjs script through the npm postinstall hook, which detects the operating system and architecture and deploys a matching binary dependency.
- The binary payloads prompt users for personal information and OpenAI or Anthropic API keys while harvesting credentials from local files.
- The Windows payload scans for credentials, downloads a file, and saves it as a DLL in the user's temporary directory.
- Defensive Notes
- NPM reportedly removed packages quickly, but the article says global CDNs and Chinese and European NPM mirrors continued to make them installable.
- Review NPM dependencies for the listed Stardrop packages and platform-specific stardrop-* packages, including their postinstall scripts and binary payloads.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | stardrop[.]dev | Listed as a Stardrop network indicator. |
| HOSTNAME | p9ia72yajp[.]us-east-1[.]awsapprunner[.]com | Listed as a Stardrop network indicator. |
| MD5 | 29b31bb2a2c4fbe0c3cec2022562927c | MD5 hash of the Stardrop Windows binary package. |
| MD5 | 43f446a86f1fbee74a486185c6dc1d51 | MD5 hash of the Stardrop Linux binary package. |
| MD5 | 823f13d45fe0dd05d2f1ac4344d8ae75 | MD5 hash of the Stardrop macOS binary package. |
| MD5 | d70e7e37dfa4cf501cbd0ef6a236c84b | MD5 hash identified for a malicious Stardrop NPM package. |
| SHA256 | 18e8742fb6fb5e70c0c91823d72f5d9074be1d1cba1cbfc0eca75b5427e544da | SHA-256 hash of the Stardrop Linux binary package. |
| SHA256 | 646f3904ff03e64229f938ac23fa8bb79ed1658ee5aa0bee4aa8909f38f763cd | SHA-256 hash of the Stardrop macOS binary package. |
| SHA256 | d780fe3b635ff099682677f3c93e42d789e572926fd0db076c27e775bb109b06 | SHA-256 hash identified for a malicious Stardrop NPM package. |
| SHA256 | f2248973be75ce70b96424edb405d5a9af3c1fbca378566bfff3c0a0994d6f48 | SHA-256 hash of the Stardrop Windows binary package. |
MITRE ATT&CK
T1059.007 · JavaScriptA package's postinstall hook runs postinstall.mjs using Bun or Node.js to deploy the platform-specific binary.T1105 · Ingress Tool TransferThe Windows payload downloads a file and saves it as a DLL in the user's temporary directory.T1195.002 · Compromise Software Supply ChainThe campaign distributed malicious payloads through packages published to the NPM package ecosystem.T1552.001 · Credentials In FilesThe payload harvests credentials from local files, including ~/.local/share/stardrop/auth.json.
Malware
Products
Node.jsOS/Architecture Detection: Uses Node.js os module to identify the victim's platformnpmOpenSourceMalware has identified an ongoing threat campaign that has published more than 200 packages to NPM so far. These packages have names like "huggingface-cli", "webflow", "bessember-vc", "omaha", "codeium",