CloudSEK and Checkmarx Identify MALFEX Campaign Pushing RATs via npm

CloudSEK and Checkmarx have disclosed details of a persistent npm supply chain malware campaign that distributes information stealers and remote access trojans to compromised hosts. The cybersecurity firms have codenamed the operation MALFEX.

According to The Hacker News, the campaign is assessed to be the work of a lone threat actor who has published twelve packages since August 2023. Of those twelve, eight have been identified as malicious. These eight packages have collectively been downloaded 40,767 times. The malware delivered includes the Overlord remote access trojan and various information stealers.

Campaign Context and Background

The MALFEX campaign represents a long-running effort to compromise developers and their environments through the Node Package Manager ecosystem. By publishing packages that appear legitimate or useful, the threat actor has managed to distribute malicious code to thousands of users.

The use of the Overlord RAT allows attackers to gain remote control over infected systems. Combined with information stealers, this capability enables the extraction of sensitive data from compromised hosts. The fact that the actor has maintained this activity since August 2023 suggests a sustained interest in targeting the JavaScript and Node.js development community.

Who Is Affected

Any developer or organization that has utilized npm to install packages during the period since August 2023 is potentially at risk. The 40,767 downloads indicate a significant reach, meaning numerous development environments may have been exposed to the Overlord RAT or associated stealers.

Organizations relying on continuous integration and continuous deployment pipelines that pull from npm should be particularly vigilant. If any of the twelve packages published by this actor were included in their dependency trees, their systems could be compromised. The impact extends beyond individual developers to the broader infrastructure that builds and deploys applications using these dependencies.

What should you do?

Security teams should audit their npm dependencies for any packages published by the actor behind MALFEX. Since no specific fix or removal of all packages has been confirmed in the source material, organizations must manually verify their supply chain integrity.

Background: Malicious npm packages

Developers often ignore version pinning, skip package audits, and leave internal registries open. These errors allow attackers to push malicious code under similar names or older versions. Fix these gaps by enforcing strict version ranges, using private mirrors, and verifying package integrity before installation.

Read the full guide: Mistakes That Let Malicious npm Packages Compromise Your Build

What to do and how to stay safe: CloudSEK

• Audit npm package dependencies to identify and remove any packages associated with the MALFEX campaign.
• Monitor system logs and network traffic for indicators of compromise related to the Overlord RAT.
• Enforce strict dependency validation and signing practices to prevent future supply chain attacks.
• Keep development environments isolated and updated to reduce the attack surface for remote access tools.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the MALFEX campaign?

MALFEX is a codename given by CloudSEK and Checkmarx to a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans.

How many malicious packages are involved?

Eight malicious packages have been identified as part of the campaign, which have been downloaded 40,767 times.

Who is behind the MALFEX campaign?

Cybersecurity researchers assess the activity to be the work of a lone threat actor who has published twelve packages since August 2023.