Ghost Campaign Uses Fake npm Install Logs to Phish sudo Passwords and Deploy a RAT

Mar 24, 2026 · Original article ↗

Summary

ReversingLabs found malicious npm packages that mimic install logs to phish for sudo passwords, then retrieve and run a RAT designed to steal crypto wallets and sensitive data. Payload details came from Telegram or teletype[.]in.

Key points

ReversingLabs identified seven malicious npm packages across multiple versions, published by the npm user “mikilanjillo”; react-state-optimizer-core is one example.
The packages display fabricated installation messages, random delays and, in some versions, progress bars to disguise malicious activity.
Fake error prompts trick users into entering sudo passwords, which the packages use to execute the final payload with elevated privileges.
The packages retrieve payload URLs and decryption-key material from a Telegram channel; [email protected] instead uses a post on teletype[.]in.
The final-stage RAT is designed to steal crypto wallets and sensitive data and to receive and execute commands from a C2 server.
ReversingLabs says its Spectra Assure system flagged the suspicious activity, which researchers then confirmed as malicious.
Similarities to a package discussed by JFrog raise the possibility that the campaign was an early test run or first wave; ReversingLabs presents this as uncertain.

Article Details

Attack Vectors: Malicious npm packages displayed fabricated installation logs, progress indicators, and delays to conceal their behavior.
The packages prompted users to enter their sudo password under false pretenses, then used the phished password to execute a downloaded final-stage payload with elevated privileges.
The packages retrieved a payload URL and part of its decryption key from a Telegram channel; one package version instead used a teletype.in post. The downloaded payload was decrypted and executed.
The final-stage RAT was designed to steal crypto wallets and sensitive data and to receive and execute commands from a C2 server.
Defensive Notes: Treat unexpected sudo-password prompts during npm package installation as suspicious, especially when accompanied by fabricated installation output.
ReversingLabs reported using Spectra Assure to detect the suspicious package behavior and marking the packages as malicious.

MITRE ATT&CK

T1005 · Data from Local SystemThe final-stage RAT was designed to steal crypto wallets and other sensitive data from the host.T1027 · Obfuscated Files or InformationThe packages concealed malicious activity with fabricated npm installation messages, randomized delays, and in some versions a progress bar driven by random values.T1078 · Valid AccountsThe packages reused the victim's phished sudo password to run the final-stage payload.T1102 · Web ServiceThe campaign used a Telegram channel, and for one package a teletype.in post, to retrieve payload URLs and key material.T1105 · Ingress Tool TransferThe packages downloaded the final-stage payload and part of its decryption key from external services.T1204.002 · Malicious FileThe malicious behavior ran after a user installed the package.T1548.003 · Sudo and Sudo CachingThe packages phished for the victim's sudo password and used it to execute the final-stage payload with elevated privileges.

Vendors

ReversingLabsReversingLabs discovered multiple malicious packages (published by user “mikilanjillo”) that retrieve decryption keys and payload URLs from a Telegram channel or a teletype.in web3 post and execute the RAT using the

Products

npmThe Ghost campaign abused malicious npm packages that display realistic fake npm install logs to phish for sudo passwords and then download and execute a final-stage RAT that steals crypto wallets and sensitive data.Spectra AssureRL researchers discovered the suspicious activities in the react-state-optimizer-core package using the Spectra Assure automated detection system.