Malware
Scavenger
aka scavenger · SCVNGR · scvngr
Scavenger is a stealthy, two-stage malware family first observed in July 2025 following a targeted supply chain attack on the NPM ecosystem.
Scavenger, also known as scavenger, SCVNGR, scvngr, is a Windows malware family.
Background
Scavenger is a covert, two-stage malware family that surfaced in July 2025 in the wake of a targeted supply chain compromise of the NPM ecosystem. The campaign opened with phishing that used a typo-squatted domain (npnjs.com) to mimic the genuine NPM login page. In a manner resembling device code phishing, the operators abused NPM's web-based login flow to coax a package maintainer into issuing an automation access token, which never expires and, depending on configuration, can sidestep 2FA.
Armed with those credentials, the attackers planted malicious payloads in a number of trusted NPM packages, eslint-config-prettier among them, by editing their install scripts to launch a DLL loader. Compiled in Visual Studio, this first-stage loader runs anti-VM checks, resolves APIs dynamically via CRC32 hashing, uses indirect syscalls to evade EDR, and decrypts its strings at runtime. When the environment clears these checks, it loads a second-stage infostealer aimed at browser data—especially from Chromium—covering extension state, cached content, and visited URLs.
For command and control, the malware relies on libcurl and ships XXTEA-encrypted payloads over HTTP(S), running challenge-response integrity checks as a session starts. Artifacts such as a leftover PDB path, along with operational overlaps, tie Scavenger to additional campaigns—including one built around an infected BeamNG game binary—pointing to a wider, still-developing threat infrastructure.
Source: Malpedia (Fraunhofer FKIE).