StegaBin: 26 npm typosquats use Pastebin steganography to deliver Contagious Interview RAT

What happened

StegaBin is Socket's name for a 26-package npm campaign published in late February 2026 and attributed to North Korea's Contagious Interview / Famous Chollima cluster. The package names are typosquats of popular libraries — fastify-lint, expressjs-lint, loadash-lint, prism-lint, and so on — with single-character or suffix variations chosen to catch typo or autocomplete installs.

The novel piece is the resolver: the loader pulls a Pastebin page where the C2 host is encoded steganographically (zero-width whitespace and Base64-in-comments), so simple HTTP traffic analysis sees only a Pastebin fetch. Decoded, the URL points to one of 31 rotating *.vercel.app deployments that serve a 9-module infostealer and RAT toolkit.

Once running, the malware enumerates browser stores (Chrome / Edge / Brave), pulls cookies and saved credentials, harvests SSH keys and Git configs, and runs TruffleHog-style scanning across disk to find further secret material. Crypto wallet extensions are a priority target. On Windows, it stages AnyDesk for hands-on follow-up and installs a keylogger.

Socket identified C2 IP 103.106.67.63 and the Vercel deployment list. Block both at egress, hunt for AnyDesk and keylogger artefacts on Windows developer hosts, and rotate any credential reachable from a host that resolved one of the 26 packages.

Affected packages (26)

Impact

• Browser credentials, crypto wallets, SSH and Git secrets exfiltrated
• TruffleHog-style scanning runs on victim disk to find more secrets
• Resilient C2 via rotating Vercel deployments + Pastebin dead-drops

What to do

1. 1Remove any of the 26 listed packages and rotate impacted credentials
2. 2Block C2 IP 103.106.67.63 and listed Vercel domains at egress
3. 3Hunt for AnyDesk and keylogger artefacts on Windows dev hosts

References

• Socket: StegaBin — 26 malicious npm packages use Pastebin steganography

  socket.dev
  Socket