MALFEX npm Supply Chain Campaign: Detecting and Removing the Overlord RAT and Info-Stealer in Your Developer Environment

---
title: NPM Install Hook Spawning Scripting or Shell Child Process
id: 3f8a1c42-7b2d-4e19-a5c6-9d0e1f2a3b4c
status: experimental
description: Detects node.exe or npm lifecycle hooks spawning cmd, powershell, curl, or other child processes — consistent with malicious npm packages such as the MALFEX campaign executing postinstall payloads.
references:
  - https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\cmd.exe'
  selection_parent_cmdline:
    ParentCommandLine|contains:
      - 'npm install'
      - 'npm ci'
      - 'postinstall'
      - 'preinstall'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_parent_cmdline and selection_child
falsepositives:
  - Legitimate build tooling (node-gyp, node-pre-gyp) compiles native modules during install; baseline known-good packages in your environment
level: high
---
title: Node Process Accessing Browser Credential Stores
id: 8c4d2e51-3a6f-4b78-9c1d-2e5f6a7b8c9d
status: experimental
description: Detects node.exe reading browser Login Data or Cookies files — a hallmark of npm-delivered info-stealers such as the MALFEX campaign payload.
references:
  - https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html
  - https://attack.mitre.org/techniques/T1555/003/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.credential_access
  - attack.t1555.003
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith: '\node.exe'
  selection_target:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\'
      - '\Microsoft\Edge\User Data\'
      - '\BraveSoftware\Brave-Browser\User Data\'
      - '\Mozilla\Firefox\Profiles\'
  selection_file:
    TargetFilename|endswith:
      - 'Login Data'
      - 'Cookies'
      - 'Web Data'
      - 'logins.json'
      - 'key4.db'
  condition: selection_image and selection_target and selection_file
falsepositives:
  - Rare; legitimate Electron apps may touch their own profile data but not other browsers' stores
level: critical
---
title: Node Process Establishing Outbound Connection to Paste or Chat CDN Infrastructure
id: 5e2b7a93-1d4c-4f08-b3a7-6c9d0e1f2a3b
status: experimental
description: Detects node.exe making outbound connections to paste sites or Discord CDN/webhook endpoints commonly abused for payload staging and exfiltration by npm supply chain malware including MALFEX.
references:
  - https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
      - '\npm.cmd'
    DestinationHostname|contains:
      - 'pastebin.com'
      - 'paste.ee'
      - 'rentry.co'
      - 'discord.com'
      - 'discordapp.com'
      - 'cdn.discordapp.com'
      - 'transfer.sh'
      - 'file.io'
  condition: selection
falsepositives:
  - Some legitimate dev tools integrate with Discord webhooks for notifications; verify against package inventory
level: high

// Hunt for npm/node install activity spawning suspicious child processes (MALFEX TTP)
// Works on DeviceProcessEvents (Defender) — extend join to DeviceNetworkEvents for C2 staging
let Lookback = 14d;
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFileName in~ ("node.exe", "npm.cmd", "cmd.exe")
| where InitiatingProcessCommandLine has_any ("npm install", "npm ci", "postinstall", "preinstall")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "curl.exe", "certutil.exe",
                      "wscript.exe", "cscript.exe", "mshta.exe", "bitsadmin.exe", "rundll32.exe")
| extend SuspiciousCommand = ProcessCommandLine
| project Timestamp, DeviceName, AccountName,
          ParentCmd = InitiatingProcessCommandLine,
          ChildProcess = FileName, SuspiciousCommand,
          SHA256, FolderPath
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where InitiatingProcessFileName in~ ("node.exe", "powershell.exe", "cmd.exe")
    | where RemoteUrl has_any ("pastebin", "discord", "rentry", "transfer.sh", "file.io")
       or RemoteIpType == "Public"
    | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
) on DeviceName, $left.FileName == $right.InitiatingProcessFileName
| project Timestamp, DeviceName, AccountName, ParentCmd, ChildProcess, SuspiciousCommand,
          RemoteUrl, RemoteIP, SHA256
| order by Timestamp desc;

-- MALFEX npm Supply Chain Triage: malicious node child processes, persistence, and credential-store access
-- Deploy as a hunt across developer workstations and build agents

SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (
  -- node/npm spawning shells, downloaders, or script engines
  (CommandLine =~ '(?i)npm (install|ci)|postinstall|preinstall'
    AND Name =~ '(?i)(powershell|pwsh|cmd|curl|certutil|wscript|cscript|mshta|bash|sh)')
  -- node itself executing encoded or download-cradle style commands
  OR (Name =~ '(?i)node' AND CommandLine =~ '(?i)frombase64string|-enc |iex|invoke-expression|downloadstring')
)

-- Companion check: registry Run key persistence referencing node or unknown binaries in user paths
-- SELECT Name, Data FROM glob(globs='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run/*',
--        accessor='registry')
-- WHERE Data =~ '(?i)node|appdata|temp'

# MALFEX npm Supply Chain Triage - Security Arsenal
# Run elevated on developer workstations and CI/CD build agents

Write-Host "=== [1/5] Installed npm global packages ===" -ForegroundColor Cyan
npm ls -g --depth=0 2>$null

Write-Host "=== [2/5] Scanning node_modules for suspicious lifecycle hooks ===" -ForegroundColor Cyan
$searchPaths = @("$env:USERPROFILE", "C:\builds", "C:\agent\_work")
foreach ($base in $searchPaths) {
    if (Test-Path $base) {
        Get-ChildItem -Path $base -Recurse -Filter "package.json" -ErrorAction SilentlyContinue |
          Where-Object { $_.FullName -match 'node_modules' } |
          ForEach-Object {
            $pkg = Get-Content $_.FullName -Raw | ConvertFrom-Json -ErrorAction SilentlyContinue
            if ($pkg.scripts -and ($pkg.scripts.preinstall -or $pkg.scripts.install -or $pkg.scripts.postinstall)) {
                $hook = "$($pkg.scripts.preinstall) $($pkg.scripts.install) $($pkg.scripts.postinstall)"
                if ($hook -match '(?i)curl|wget|powershell|invoke|eval|base64|http') {
                    Write-Warning "Suspicious install hook: $($_.FullName)`n  -> $hook"
                }
            }
          }
    }
}

Write-Host "=== [3/5] Checking persistence (Run keys / Scheduled Tasks referencing node or user-writable paths) ===" -ForegroundColor Cyan
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
                 "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue |
  Out-String | Select-String -Pattern '(?i)node|appdata|temp' | ForEach-Object { Write-Warning $_.Line }
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match '(?i)node|powershell' -and
  $_.Actions.Arguments -match '(?i)appdata|temp|-enc' } |
  ForEach-Object { Write-Warning "Suspicious task: $($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)" }

Write-Host "=== [4/5] Node processes with active outbound connections ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName -match 'node' } |
  Where-Object { $_.RemoteAddress -notmatch '^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)' } |
  Select-Object LocalPort, RemoteAddress, RemotePort, OwningProcess,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).ProcessName}} | Format-Table -AutoSize

Write-Host "=== [5/5] Browser credential-store access check (recent prefetch/amcache not covered - manual DFIR if hits above) ===" -ForegroundColor Cyan
Write-Host "If any warnings fired above: isolate host, rotate ALL credentials reachable from it (npm tokens, SSH keys, cloud creds, browser passwords), and reimage if Overlord RAT activity is confirmed." -ForegroundColor Yellow