<![CDATA[Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer]]>

<![CDATA[Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer]]>Cybersecurity researchers have disclosed a long-running npm supply chain malware campaign that distributes information stealers and remote access trojans (RATs) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx.

The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have been downloaded 40,767 times. These packages deliver the Overlord RAT and a stealer.

Given the available information, no specific CVE identifiers or advisory numbers have been published for this campaign.

Key details to note:

Campaign codename: MALFEX
Attributed by: CloudSEK and Checkmarx
Actor profile: assessed to be a lone threat actor
Packages published: 12 since August 2023
Malicious packages: 8, downloaded 40,767 times
Payloads: Overlord RAT and an information stealer
Distribution vector: npm supply chain

If your organization uses npm dependencies, review your package inventory for anything published since August 2023 that matches this activity and audit install scripts and post-install behavior in your build pipeline.

Source: The Hacker News

Has your team audited its npm dependencies for these packages, and what controls are you using to catch malicious install scripts before they run?

]]>https://xploitlk.com/topic/608/eight-malicious-npm-packages-downloaded-40-767-times-deliver-overlord-rat-and-stealerRSS for NodeTue, 27 Oct 2026 07:51:33 GMTThu, 08 Oct 2026 04:30:24 GMT60