Eight Malicious npm Packages Deliver Overlord RAT and Stealer in Supply Chain Campaign

A long-running npm supply chain malware campaign codenamed MALFEX has been disclosed by cybersecurity researchers CloudSEK and Checkmarx. The campaign involves a lone threat actor who published 12 packages to the npm registry since August 2023, eight of which deliver Overlord RAT and an information stealer malware. Combined, the eight malicious packages have been downloaded 40,767 times. The threat actors' objective appears to be credential theft, data exfiltration, and remote access compromise of developer workstations. The research indicates the actor has been active for several months, with new packages potentially still being published. The delivery mechanism involves standard npm installation, with the malicious code executing after a user installs the compromised package. No specific CVEs have been assigned, as the issue stems from malicious package authorship rather than a vulnerability in legitimate software. The findings underscore the need for heightened scrutiny of npm packages, particularly those with low download counts or unfamiliar publishing names.