New npm Infostealer Discovery: Nyx Stealer Hijacks Discord Sessions

TL;DR The Xygeni Security Research Team identified a sophisticated npm infostealer campaign delivered through two malicious packages: consolelofy and selfbot-lofy . The latest version ( consolelofy@1.3.0 ) embeds a 216KB AES-encrypted payload that decrypts at runtime and executes via vm.runInNewContext() . Because the malicious logic is fully encrypted, static scanners relying on string inspection cannot observe its behavior until execution time. Once decrypted, the payload, internally branded Nyx Stealer , targets: Discord authentication tokens 50+ browser credential stores 90+ cryptocurrency wallet extensions Roblox, Instagram, Spotify, Steam, Telegram, and TikTok sessions Discord desktop client persistence All 20 versions across both packages were reported and confirmed malicious. Technical Overview of This npm Infostealer Unlike traditional install-time malware, this campaign relies on a runtime decryption model . There are: No malicious preinstall or postinstall hooks No obvious i