Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Summary: CloudSEK and Checkmarx disclosed a long-running npm supply chain campaign, codenamed MALFEX, in which a lone actor published 12 packages since August 2023 and eight were flagged as malicious, collectively downloaded 40,767 times. Three packages act as Overlord RAT loaders via lifecycle hooks, three others fetch a Go executable that pulls a Node.js stealer, and "function-flag" alone accounts for 37,419 downloads with a postinstall hook that downloads node.exe from a Brazilian hosting service and runs it hidden.
Bottom line: One package, "function-flag," drove 37,419 of the 40,767 downloads, and its postinstall hook runs automatically on install - no one has to launch anything for the payload to execute. The same Overlord RAT has surfaced in a WordPress exploitation campaign and a fake Zoom installer tied to a suspected North Korea-aligned cluster, so a single npm dependency now sits on the same tooling path as those operations.
Read the original at The Hacker News ↗
- Topics
- Malware
- Mentions
- CVE-2026-60137CVE-2026-63030
- Related