Reported by 2 outlets
MALFEX: eight malicious npm packages deliver Overlord RAT, 40,767 downloads
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.36 / 0.6 · time to second source
- Recency
- × 0.02 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.1 / 10 = base × recency + community
Desk analysis
MALFEX delivered the Overlord RAT and an infostealer through eight malicious npm packages published since August 2023, accumulating 40,767 total downloads. The packages had 12 releases and targeted developers with a supply-chain infection that runs both remote-access and credential-stealing payloads. This is a sustained campaign, not a one-off package drop, because the download count spans more than a year of releases.
The threat is supply-chain compromise at scale: 40,767 downloads across 12 releases means widespread potential infection of developer machines and downstream build environments. No CVE is assigned to the malicious packages themselves; the harm is operational malware delivery rather than a vulnerability in a legitimate package. Watch for additional releases from the same publisher patterns and for Overlord RAT detections in build pipelines.
Timeline
-
original reporting
🤖 MALFEX: eight malicious npm packages (12 published since Aug 2023) pulled 40,767 downloads, delivering the Overlord RAT and an infostealer
thehackernews.com · 5d ago · October 8th, 2026
🤖 MALFEX: eight malicious npm packages (12 published since Aug 2023) pulled 40,767 downloads, delivering the Overlord RAT and an infostealer
via Mastodon https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html
-
update from thehackernews.com
Eight malicious npm packages downloaded 40,767 times deliver Overlord RAT and stealer
thehackernews.com · 6d ago · October 7th, 2026
The article reports that eight malicious npm packages, with 12 releases since August 2023, accumulated 40,767 total downloads and delivered the Overlord RAT alongside an infostealer. It names the campaign MALFEX and references the threat coverage. Published meta timestamp is 2026-10-07 17:43 UTC, earlier than the 2026-10-08 Mastodon reference.
-
update from threatnoir.com
⚠️ CRITICAL: Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer Eight malicious npm packages (40,767+ dow
threatnoir.com · 5d ago · October 8th, 2026
⚠️ CRITICAL: Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer Eight malicious npm packages (40,767+ dow
via Mastodon https://threatnoir.com/focus