Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
-
Cybersecurity researchers have disclosed a long-running npm supply chain malware campaign that distributes information stealers and remote access trojans (RATs) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx.
The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have been downloaded 40,767 times. These packages deliver the Overlord RAT and a stealer.
Given the available information, no specific CVE identifiers or advisory numbers have been published for this campaign.
Key details to note:
- Campaign codename: MALFEX
- Attributed by: CloudSEK and Checkmarx
- Actor profile: assessed to be a lone threat actor
- Packages published: 12 since August 2023
- Malicious packages: 8, downloaded 40,767 times
- Payloads: Overlord RAT and an information stealer
- Distribution vector: npm supply chain
If your organization uses npm dependencies, review your package inventory for anything published since August 2023 that matches this activity and audit install scripts and post-install behavior in your build pipeline.
Source: The Hacker News
Has your team audited its npm dependencies for these packages, and what controls are you using to catch malicious install scripts before they run?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login