Malicious npm package delivers cross‑platform RAT that exfiltrates data via HuggingFace
The analysis uncovers a supply‑chain attack where the npm package js‑logger‑pack evolved through 29 versions into a binary dropper called MicrosoftSystem64, a cross‑platform RAT. It harvests credentials, crypto wallets, screenshots and other data, uploading everything to private HuggingFace datasets to avoid detection. Developers are urged to remove the packages and rotate all credentials.