Someone hid a full RAT inside a fake npm package and exfiltrated victim data to HuggingFace (opens in new tab)

Deep technical analysis of MicrosoftSystem64, an 81 MB Node.js SEA binary deployed via malicious npm packages. This RAT steals browser credentials, 80+ crypto wallet extensions, Telegram sessions, SSH keys, and screenshots, exfiltrating everything to HuggingFace datasets while maintaining persistence across Windows, macOS, and Linux.