New ‘StegaBin’ Campaign Deploys Multi-Stage Credential Stealer via 26 Malicious npm Packages

StegaBin is a supply-chain attack targeting JavaScript developers via 26 malicious npm packages (typosquatting popular libraries) that deploy a multi-stage credential stealer and RAT; the loader uses Pastebin text steganography to reveal Vercel-hosted staging domains, fetches platform-specific payloads, and installs a parser.js RAT that communicates with 103.106.67.63:1244. The toolkit includes VSCode persistence, keylogging, clipboard and browser credential theft, Git/SSH exfiltration, and redeployment for persistence, and the activity is attributed to the DPRK-aligned FAMOUS CHOLLIMA actor.