Typosquatting campaign delivers r77 rootkit via npm

ReversingLabs identified a typosquatting npm package, "node-hide-console-windows" (one-letter variant of a legitimate module), that downloaded a DiscordRAT 2.0 executable which can create per-victim Discord channels, execute commands (including disabling defenses) and launch the r77 rootkit to hide processes and paths; later versions also fetched a PyInstaller Blank-Grabber infostealer. The report documents analysis results, extracted Discord bot token and guild ID, lists IOCs, and warns that open-source malware and typosquatting on public repositories amplify software supply chain risk.