Act
active
Eight Malicious npm Packages Delivering Overlord RAT and Stealer
- Engineer — Act: Active supply-chain compromise in npm with RAT and stealer payloads across 8 packages downloaded 40k+ times since Aug 2023. Audit all projects for the named MALFEX packages, remove any matches, and inspect CI/CD build logs for evidence of execution.
- SOC/IR — Plan: Named malware (Overlord RAT) and stealer campaign with developer-endpoint reach; obtain full IOC lists from the CloudSEK/Checkmarx reports and build detections for Overlord RAT callbacks and credential-stealer behaviors on developer workstations and CI runners.
- Leader — Learn: Illustrates ongoing npm supply-chain risk from low-signal lone-actor campaigns; useful background for a software supply chain risk discussion with engineering leadership, but not a systemic event requiring immediate escalation.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.