Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

A supply chain attack dubbed MALFEX has distributed eight malicious npm packages, collectively downloaded over 40,000 times, delivering the Overlord RAT and a Node.js-based information stealer. The threat actor, believed to be Portuguese-speaking, uses postinstall hooks to execute malicious JavaScript payloads that download Windows executables from suspicious domains. Some packages act as loaders for Overlord RAT, while others deploy a stealer targeting Discord, browsers, Telegram, and cryptocurrency wallets, with infrastructure hosted on a Brazilian application platform.

AI-extracted · verify before operational use