Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have

Researchers reported that eight malicious npm packages in the MALFEX campaign were downloaded 40,767 times and delivered Overlord RAT, an information stealer, or additional Windows executables through package-install and related execution paths. The report concerns general software supply-chain malware rather than AI-specific systems, models, or agents. RealGround analysis: organizations incorporating npm dependencies into AI applications or AI-enabled services should inventory and monitor third-party packages, enforce provenance and lockfile controls, and assess whether compromised developer or runtime environments could expose AI data or credentials.