These npm packages are malicious by design and impersonate internal runtime and client utilities. On import they run a loader that retrieves stealer code from a remote dead drop and executes it in memory, harvesting Chrome extension storage on Windows, macOS and Linux. On Windows they additionally capture clipboard contents and keystrokes on operator command.