Sophisticated ‘duer-js’ NPM Package Distributes ‘Bada Stealer’ Malware Targeting Windows and Discord Users

A malicious NPM package named "duer-js" (Bada Stealer) masquerading as a console tool delivers a multi-stage infostealer that targets Windows developers and users: it kills browsers/Telegram to access locked data, extracts Discord tokens, saved browser credentials, payment details, and cryptocurrency wallet files, establishes persistence by injecting into Discord startup, and exfiltrates stolen data via Discord webhooks and Gofile. JFrog researchers analyzed its obfuscation and the report provides step-by-step cleanup and mitigation guidance (uninstall/reinstall Discord, remove startup node.exe, revoke tokens, change passwords, check wallets/Steam).