This stealer is easier to analyze than it looks. The wrapper is obfuscated, but the malicious payloads are embedded in plain text, so static review can still recover behavior and indicators without waiting for detonation.
SANS ISC identified a Node.js stealer targeting Windows via WSL, macOS, and Linux. The report says the code exfiltrates data with Axios to hxxp://216[.]126[.]225[.]243:8086/upload, which gives defenders a concrete network indicator and a workable file-based detection path across developer and endpoint environments.