A supply chain worm attack targeting npm ecosystem that steals developer credentials and self-propagates through compromised packages. The malware collects sensitive data including tokens, API keys, SSH keys, cloud service credentials, CI/CD systems, registries, LLM platforms, and Kubernetes/Docker configs. It also extracts data from Chrome and Firefox browsers including cryptocurrency wallets (MetaMask, Exodus, Atomic Wallet, Phantom). The malware searches for npm publish tokens in environment variables or ~/.npmrc files, identifies packages the victim can publish, injects payload, and republishes with increased version numbers. It also targets PyPI credentials for Python packages using .pth-based payload, making it a multi-ecosystem attack.