[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fkEms5-V8tJWFKapa2J2rnkVBKQbiSikkcWrR035eeMs":3},{"article":4,"iocs":43},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":25},"fdccfa18-b4f0-4346-8b6c-c24f6d9679c9","MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work","malfex-npm-malware-campaign-three-payloads-and-an-adversary-that-signs-their-wor-2929a4","The MALFEX campaign is a long-running npm supply-chain attack that delivers Remote Access Trojans (RAT), information stealers, or open Node.js processes as payloads. Learn about how the attack works, how to find out if you're impacted, and what response actions to take.","The MALFEX campaign is an ongoing supply-chain attack targeting the npm JavaScript package registry. Attackers are injecting malicious code into legitimate packages, which then deliver various payloads including Remote Access Trojans (RATs), information stealers, or open Node.js processes. The campaign is notable for the adversary signing their malicious code, potentially to evade detection or mislead analysis.","MALFEX npm campaign delivers RATs, info-stealers, or open Node.js processes as payloads.",null,"https:\u002F\u002Fcheckmarx.com\u002Fzero-post\u002Fmalfex-npm-malware-campaign-three-payloads-and-an-adversary-that-signs-their-work\u002F","https:\u002F\u002Fcheckmarx.com\u002Fstaging.checkmarx.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fcxzero_blog-2026-10-anurag-malfex-npm-campaign_image01-1024x645.webp","2026-10-05T15:20:39+00:00","2026-10-05T16:01:21.126424+00:00",8,[18],{"name":19,"type":20},"npm","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":21,"icon":11,"name":23,"slug":24},"Supply Chain","supply-chain",[26,28,33,38],{"category":27},{"id":21,"icon":11,"name":23,"slug":24},{"category":29},{"id":30,"icon":11,"name":31,"slug":32},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":34},{"id":35,"icon":11,"name":36,"slug":37},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":39},{"id":40,"icon":11,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44],{"type":32,"value":45,"context":46},"MALFEX","Name of the malware campaign"]