Malicious npm Packages Posing as Solara Executor Target Discord, Browsers, and Crypto Wallets

Cybersecurity: Malicious npm Packages Target Discord and Cryptocurrency Wallets

On March 12, 2026, JFrog security researchers identified a sophisticated supply chain attack on the npm ecosystem. This attack involved threat actors deploying information-stealing malware disguised as a legitimate Roblox script executor.

The campaign, named Cipher stealer, utilized two malicious packages, bluelite-bot-manager and test-logsmodule-v-zisko , to deliver a Windows executable. This executable was capable of harvesting Discord credentials, browser data, and cryptocurrency wallet files from compromised systems.

The malicious packages contained a pre-install script that downloaded and executed a Windows binary, either solara 1.0.0.exe or solara 1.0.1.exe , from a Dropbox-hosted URL without user interaction. This executable functioned as a dropper, containing a 321MB archive with obfuscated JavaScript, a full Node.js runtime, and an embedded Python script, enabling the stealer to operate without additional setup by the attacker.

Despite the payload's complexity, only one antivirus engine on VirusTotal flagged the executable, as many scanners only analyzed the clean outer layer.

Cipher targeted Discord by stealing session tokens from LevelDB databases across installed Discord clients and Chromium-based browsers. It then validated these tokens against Discord's API. For BetterDiscord users, the malware altered the index.js file to bypass webhook protection, allowing data exfiltration to the attacker's Discord webhook.

On the official Discord desktop client, a secondary JavaScript payload was downloaded from a GitHub repository, capturing user credentials and payment details upon re-login after forcing a logout.

The malware extracted browser credentials using Windows DPAPI decryption libraries and queried browser databases for saved passwords. Additionally, a Python script extended the attack to a broader range of browsers, extracting cookies, credit card information, and browsing history.

The malware also targeted cryptocurrency wallet directories, copying and attempting to decrypt wallet files. All exfiltrated data was compressed into a ZIP archive and uploaded to a command-and-control server, with a summary report sent to the attacker's Discord webhook.

Both npm packages have been removed, and the Dropbox links are inactive. However, the secondary GitHub repository hosting the injection script was still active at discovery time. Affected users should uninstall the packages, reinstall the Discord desktop application, change all passwords and session tokens, and review their cryptocurrency wallets for unauthorized access.

Based on reporting by Cyber Security News.