Malware

data_extracter

data_extracter is a cross-platform credential-stealing binary delivered in a malicious npm supply-chain campaign targeting developer machines on Windows, Linux, and macOS. The referenced packages execute automatically during npm install via a postinstall script, display a fake CAPTCHA, fingerprint the victim system, and then download a roughly 24 MB binary named data_extracter. The malware is described as a PyInstaller-packaged Python application containing its own runtime and resources so it can execute even if Python is not installed on the victim host. Its capabilities include extracting credentials and secrets from multiple sources, including browser SQLite databases holding cookies and saved passwords, system keyrings such as Windows Credential Manager, macOS Keychain, and Linux SecretService, as well as SSH keys, tokens, API keys, and other service credentials stored in configuration files. The stolen data is then exfiltrated to attacker-controlled infrastructure. High-confidence targeting in the content is developer environments and developer credentials/CI secrets exposed through malicious npm packages; no specific threat actor attribution or concrete IOC values are provided in the content.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

1 technique

T1497.001System ChecksEvidence1

After the fake CAPTCHA is solved, a binary called “data_extracter” is downloaded from the same remote server, with a different version installed based on the victim’s operating system (Windows, Mac or Linux).

Credential Access

5 techniques

T1528Steal Application Access TokenEvidence1

The infostealer also leverages specialized libraries for extracting OAuth tokens, JSON Web Tokens (JWTs) and LaunchPad credentials...

T1552.001Credentials In FilesEvidence1

...and configuration files containing API keys and service credentials.

T1555Credentials from Password StoresEvidence1

The application is a credential stealer designed to extract credentials from multiple locations including system keyrings (Windows Credential Manager, macOS Keychain and Linux SecretService), browser SQLite databases containing cookies and passwords and configuration files containing API keys and service credentials.

T1555.003Credentials from Web BrowsersEvidence1

T1649Steal or Forge Authentication CertificatesEvidence1

The application is a credential stealer designed to extract credentials from multiple locations including system keyrings (Windows Credential Manager, macOS Keychain and Linux SecretService)...

Discovery

1 technique

T1497.001System ChecksEvidence1

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

In the meantime, the malware retrieves the victim’s IP address and exfiltrates it to the attacker’s server.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

scworldNews

Oct 29, 2025

Credential-stealing npm packages hide beneath 4 layers of obfuscation

Credential-stealing malware distributed via malicious npm packages, designed to extract credentials from system keyrings, browsers, and configuration files, with a focus on developer environments and CI/CD pipelines.

cert eu threat intelNews

Jan 11, 2025

Cyber Brief 25-11 - October 2025

Cross-platform credential stealer distributed via typosquatted npm packages, exfiltrating browser passwords, SSH keys, and other secrets.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.