Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

Cybersecurity researchers from CloudSEK and Checkmarx have uncovered a long-running npm supply chain malware campaign dubbed MALFEX. A lone threat actor has published 12 malicious npm packages since August 2023, eight of which have been downloaded over 40,767 times. The packages deliver the Overlord RAT and an information stealer to compromised hosts. The campaign represents a sustained effort to abuse the npm ecosystem for malware distribution. The malicious packages masquerade as legitimate ones to trick developers into installing them. Once installed, they establish remote access and exfiltrate sensitive information from victim systems.