A JavaScript stealer is malware written in JavaScript to quietly collect sensitive data from a browser, local storage, application state, or extension data. It may run in a web page, a malicious script, or a package install step, then copy tokens, cookies, session data, credentials, or other browser-adjacent secrets to an attacker-controlled location.
It matters because JavaScript is common in development and web ecosystems, so malicious code can blend into trusted workflows. In real attacks, stealers often arrive through compromised dependencies, injected scripts, or fake browser tooling, and they abuse normal APIs instead of obvious exploits. Defenders reduce risk by auditing dependencies, monitoring install-time execution, limiting what extensions store persistently, and watching for unusual data access or outbound requests from scripts that should not handle secrets.