MALFEX Supply Chain Campaign Targets npm and GitHub

CloudSEK researchers track MALFEX, a threat actor that has run a supply chain campaign against npm and GitHub for two years, active since 2023. Malicious packages carry postinstall scripts that deliver Overlord RAT to Windows hosts, and the stolen data includes Discord tokens, browser credentials, and cryptocurrency wallet material. The campaign is not historical: CloudSEK's report covers packages that are still active, and hackread's coverage stresses the same.

The mechanics are the familiar npm failure mode. A postinstall script runs automatically during package installation, so a developer or a CI runner executing a routine npm install hands the attacker code execution with the user's privileges, before any code review or runtime protection applies. Overlord's target list, Discord tokens, browser-stored credentials, and crypto wallets, maps directly onto what a developer workstation holds. A campaign sustaining itself since 2023 shows the ecosystem's scanning and takedown loop still misses this family.

Treat unexpected postinstall scripts as untrusted code and audit lockfiles for packages nobody deliberately added. Watch for npm or GitHub takedowns of the named packages, new package names from the same actor, and any disclosure of Overlord command and control infrastructure, which would let defenders sweep for victims.