Windows Infostealer: undicy-http

TL;DR

undicy-http@3.0.2 is a typosquat of the Node.js undici HTTP client. It ships a single 584KB fully obfuscated index.js file containing a Windows infostealer with DPAPI password decryption, browser credential theft (Chrome/Edge), screenshot capture, Discord and Telegram token theft, cryptocurrency wallet extraction, and webhook-based data exfiltration. It declares 10 phantom dependencies (never imported via require/import) that are instead bundled into the obfuscated blob — including @primno/dpapi, sqlite3, and koffi, all of which have native install lifecycle scripts.

Package Info

Dependencies (The Infostealer Toolkit)

All 10 phantom dependencies are bundled into the obfuscated index.js rather than imported normally, making static analysis impossible.

Evidence

1. Massive Obfuscated Single File

index.js is a single line of 584,471 characters — fully obfuscated with javascript-obfuscator using _0x hex-encoded variable patterns:

const a0_0x1c4de2=a0_0x8079;function a0_0x8079(_0x5098c7,_0x3d8e09){
  _0x5098c7=_0x5098c7-0x16b;const _0x2fdbfc=a0_0x2fdb(...

2. Windows DPAPI Credential Decryption

Scanner detected browser_chrome_creds rule. The package references DPAPI (Windows Data Protection API) for decrypting browser-stored passwords. The @primno/dpapi dependency provides native bindings for CryptUnprotectData, which Chrome uses to encrypt saved credentials on Windows.

3. Browser Credential Theft

From static analysis of the obfuscated code, the package targets:

• Login Data — Chrome/Edge saved passwords (SQLite database)
• Cookies — Browser session cookies
• Local State — Chrome master key for decryption
• 9 distinct references to browser credential paths detected

4. Screenshot Capture

7 references to screenshot functionality detected. The screenshot-desktop dependency captures the user's desktop, likely to photograph open banking/crypto interfaces.

5. Discord Token Theft

19 references to Discord detected. Targets Discord's local storage for authentication tokens, enabling full account takeover.

6. Telegram Session Theft

10 references to Telegram detected. Steals Telegram session files, allowing the attacker to clone the victim's Telegram account.

7. Cryptocurrency Wallet Extraction

70 references to wallet-related strings detected. This is the primary payload target — extracting seed phrases, private keys, and wallet data from browser extensions and desktop wallet applications.

8. Webhook Exfiltration

5 references to webhook endpoints detected. Stolen data is sent to attacker-controlled webhook URLs (likely Discord webhooks) for collection.

9. Phantom Dependencies with Native Lifecycle Scripts

Three phantom deps have install lifecycle scripts that compile native code:

• @primno/dpapi: install: "exit 0" (pre-built binaries)
• koffi: install: "node src/cnoke/cnoke.js -P . -D src/koffi --prebuild" (also contains eval())
• sqlite3: install: "prebuild-install -r napi || node-gyp rebuild"

10. Windows-Only Build Target

The pkg configuration targets node20-win-x64 exclusively:

"pkg": {
  "targets": ["node20-win-x64"],
  "assets": [
    "./node_modules/@primno/dpapi/prebuilds/win32-x64/@primno+dpapi.node",
    "./node_modules/sqlite3/build/Release/node_sqlite3.node"
  ]
}

This confirms the package is a Windows-specific infostealer, bundling native .node binaries for DPAPI and SQLite access.

MITRE ATT&CK Mapping

Verdict

Malicious — Full-Featured Windows Infostealer. This is a complete credential-stealing toolkit disguised as a typosquat of the popular undici HTTP client. It targets browsers (Chrome/Edge passwords, cookies), messaging apps (Discord, Telegram), and cryptocurrency wallets. The entire payload is obfuscated into a single 584KB line to prevent analysis. All critical dependencies are bundled as phantoms with native lifecycle scripts. This is production-grade malware.

Remediation

npm uninstall undicy-http
# Scan for compromise:
# - Rotate all browser-saved passwords
# - Revoke Discord/Telegram sessions
# - Move cryptocurrency to new wallets
# Install the real package:
npm install undici

Credits

• Discovered by: Yuri Borges Martins
• Tool: npm-sentinel (AI-Powered NPM Malware Hunter)
• Date: 2026-04-03