As cited
Copy frozen at (site build).
threat intel
Long-Running NPM Malware Campaign Accumulates 40,000 Downloads
Researchers tracked a supply chain campaign called MALFEX that has published eight malicious packages to the Node Package Manager (NPM) registry since August 2023, accumulating approximately 40,000 downloads. The campaign demonstrates the persistence of automated infrastructure used by attackers to distribute malware through a widely-used dependency repository.
Why it matters: Development teams using NPM dependencies are exposed to this campaign; practitioners should audit projects for malicious MALFEX packages and implement supply chain security controls to detect suspicious package behavior.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Long-Running NPM Malware Campaign Accumulates 40,000 Downloads
Researchers tracked a supply chain campaign called MALFEX that has published eight malicious packages to the Node Package Manager (NPM) registry since August 2023, accumulating approximately 40,000 downloads. The campaign demonstrates the persistence of automated infrastructure used by attackers to distribute malware through a widely-used dependency repository.
Why it matters: Development teams using NPM dependencies are exposed to this campaign; practitioners should audit projects for malicious MALFEX packages and implement supply chain security controls to detect suspicious package behavior.
- Source published
- First seen by Cybersecurity Tracker