# @kindo/selfbot npm package delivers XWorm RAT via 5-stage Astral Warfare chain

> JFrog identified `@kindo/selfbot` (XRAY-964727), a video-game-themed Discord selfbot npm package. A 5-stage chain (JS downloader → 250KB obfuscated batch → PowerShell process injection → XOR-decoded shellcode → XWormClient .NET RAT) installed itself against `explorer.exe` with AMSI/ETW evasion.

- Published: 2026-04-15
- Severity: high
- Kind: Malicious package - A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.
- Ecosystems: npm
- Scope: 1 package, 5 compromised versions
- Tags: typosquat, infostealer, credential-theft, obfuscation
- Also known as: Astral Warfare, Astral Injection
- Detected by: JFrog
- Incident ID: npm-2026-04-15-kindo-selfbot-xworm

## Affected packages (1)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@kindo/selfbot](https://dependencywatch.io/package/npm/@kindo/selfbot) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 |

## What happened

JFrog flagged `@kindo/selfbot` (XRAY-964727) on 15 April 2026 - a video-game-themed Discord selfbot npm package distributed alongside a fake indie game branded **"Astral Warfare"** at `astralwarfare.fr`. Distribution leans on social engineering through hijacked Discord accounts: contacts of compromised users receive a "Would you test my new game?" pitch directing them to the site.

The execution chain runs five stages:

1. JS downloader stub in `@kindo/selfbot`.
2. A ~250KB obfuscated batch script (SHA-256 `0b2ce48e4be6a6be85565ce309d2f10cc1b3179a03d25a61f66c6b50fe37b010`).
3. PowerShell process-injection loader (SHA-256 `7a8cef4bfa1ca9c24be4886136c30402d4433310283aee22e2da67cbb938b3a9`) with AMSI / ETW evasion targeting `explorer.exe`.
4. XOR-decoded shellcode (SHA-256 `1255d41081452cd8fa2358860449bbf3b3494b80282e2bb4ba6b6980ceaf9be1`).
5. XWormClient .NET RAT v7.4 (SHA-256 `c26f8d09e0486aacba414f04c310c6532541d2cdf3f40d95e3fe224d9b77e0a6`), C2 `185.94.29.43:7004`, protocol separator `<Xwormmm>`.

XWorm 7.4 ships the usual capability set - RCE, DDoS, screenshot, USB propagation, plugin loader, window monitoring - and persists via a scheduled task named `applicationbackup_*` plus an `IntelDriver` directory under `C:\ProgramData`. Developers who installed `@kindo/selfbot` should treat Discord tokens, npm tokens, SSH keys and any cloud / DB credentials reachable from the workstation as exposed.

## Impact

- Full RAT capabilities: RCE, DDoS, screenshot, plugin loading
- Persistence via scheduled task `applicationbackup_*`
- Discord, npm, SSH and cloud credential exposure for developers who installed

## What to do

1. Uninstall `@kindo/selfbot`, purge node_modules, set `npm config set ignore-scripts true`
2. `schtasks /delete /tn "applicationbackup_*" /f` and remove `IntelDriver` dirs under `C:\ProgramData`
3. Rotate Discord tokens, npm tokens, cloud and DB credentials
4. Block astralwarfare.fr and 185.94.29.43 at egress

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [Astral Injection: 5-stage XWorm delivery via npm](https://research.jfrog.com/post/astral-injection/) - JFrog

---

Canonical page: https://dependencywatch.io/incident/npm-2026-04-15-kindo-selfbot-xworm
Markdown version: https://dependencywatch.io/incident/npm-2026-04-15-kindo-selfbot-xworm.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).