Loading malware…
Scavenger Loader is a Windows-focused malware component used in software supply-chain compromises to execute a staged payload chain and retrieve follow-on information-stealing malware. It has been observed embedded in trojanized package releases in both npm and PyPI ecosystems, including compromises associated with eslint-config-prettier and num2words. In these incidents, attackers used stolen maintainer credentials or tokens obtained through phishing to publish malicious package versions that executed the loader on victim systems.
The malware is implemented as a malicious DLL that is invoked by injected package code during installation or package initialization on Windows hosts. Its role is to evade detection and contact external command-and-control infrastructure to download additional payloads, including multiple stealer modules collectively referred to as Scavenger Stealer. Reported follow-on modules were offered as distinct variants, and the broader activity indicates a modular delivery architecture.
Observed behavior includes exfiltration-oriented tasking, with specific targeting of developer credential material such as Python repository configuration files that may contain publishing credentials. The malware therefore presents both endpoint compromise risk and downstream supply-chain risk, as stolen repository credentials can enable further package hijacking and malicious publication activity. Scavenger Loader is best characterized as a delivery-stage malware family associated with credential theft and follow-on infostealer deployment in developer and software build environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-54313 (CVSS score: 7.5) - An embedded malicious code vulnerability in eslint-config-prettier that could allow for execution of a malicious DLL dubbed Scavenger Loader that's designed to deliver an information stealer
6 distinct techniques documented for this family, organized by ATT&CK tactic.
the num2words PyPI package had been compromised and v0.5.15 was exhibiting signs of distributing the Scavenger Malware... Later, the project distributed v0.5.16 of the package, however, the code was still backdoored.
"CVE-2025-54313 refers to a supply chain attack targeting eslint-config-prettier and six other npm packages... The phishing campaign targeted the package maintainers with bogus links that harvested their credentials... allowing the threat actors to publish trojanized versions."
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malicious DLL loader delivered via a trojanized npm package supply-chain compromise; it is designed to execute and deliver an information-stealer payload.
A malicious DLL-based loader delivered via a compromised PyPI package on Windows. It executes during package initialization, communicates with C2 using XXTEA, exfiltrates .pypirc repository credential files, and downloads additional stealer modules.
Scavenger Loader is a malware loader used as the final payload in npm supply chain attacks, enabling the delivery of additional malicious software.
A Windows DLL-based loader embedded in trojanized npm packages; designed to evade detection and fetch/deliver an additional stealer payload from an external server.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.