When developers install what they believe to be standard Express or React packages, they may unknowingly execute a Linux worm at installation time. This threat spreads through multiple vectors, including SSH connections and Arch User Repository (AUR) packages, because it extracts active credentials such as npm tokens from infected environments.

First, the malware installs a backdoor using the Tor network, which anonymizes the attackers' command traffic. Second, it searches for local keys to hop to other servers, meaning a single compromised development environment can expose an entire internal network.