xboxauthwrapper@3.9.8

Analysis

xboxauthwrapper@3.9.8 is a trojanized npm package that poses as an Xbox authentication utility but is a Discord bot-based Remote Administration Tool (RAT). On import, it fetches an obfuscated Discord bot token and channel configuration from a remote endpoint, decrypts it, and connects to Discord as a bot. It then sends the victim's machine hostname to the attacker's Discord channel (system fingerprinting) and registers chat-command listeners: .runcmd executes arbitrary shell commands on the victim's machine via child_process.exec() and returns output to the attacker; .searchdir lists directory contents; .upload exfiltrates arbitrary files via Discord message attachments. The code is heavily obfuscated with a custom string-encoding layer to evade detection.