textdecode@1.2.7

Analysis

textdecode@1.2.7 is a credential-stealing Trojan disguised as a text decoder library. When required, lib/utf8-decoder.js (heavily obfuscated) executes immediately. It decrypts browser-saved credentials from Chrome, Edge, and Brave using the Windows DPAPI (via @primno/dpapi), reads stored passwords and cookies from browser profile directories (Login Data, Cookies, Local State). It targets 30+ crypto wallet browser extensions including Metamask, Coinbase, Phantom, Trust, BinanceChain, Exodus, Keplr, OKX, and others by scanning their extension storage. It steals Discord authentication tokens from both the Discord desktop app (Local Storage, leveldb) and browser profiles. It collects system fingerprints (hostname, username, OS, architecture, hardware UUID via wmic). Stolen data is exfiltrated through the Dropbox API (api[.]dropboxapi[.]com and content[.]dropboxapi[.]com) using hardcoded application credentials for uploading/downloading files. It uses PowerShell with hidden windows to zip collected data, and can kill processes via taskkill.