NPM Supply Chain Attack Uses undicy-http to Deploy RAT

A highly sophisticated npm supply chain attack that abuses a fake HTTP client package to deliver both a powerful RAT and a stealthy browser stealer.

The malicious package, undicy-http@2.0.0, was uploaded to npm to impersonate undici, the official HTTP client widely used in Node.js projects.

Despite the similar name, it contains no HTTP client logic; instead, its bin entry points straight to an obfuscated index.js payload.

The package metadata and code strongly tie it to the LofyGang threat group, including the author “ConsoleLofy”, hardcoded “Lofygang” strings, and Portuguese status messages.

Once executed, the script first re-launches itself in a hidden context using a temporary VBScript wrapper and the _NYX_HIDDEN environment variable to avoid visible console windows.

The JFrog Security research team identified a malicious npm package undicy-http (version 2.0.0) masquerading as the popular undici HTTP client library.

From there, it connects to a WebSocket C2 server at ws://24[.]152[.]36[.]243:3000, registering as “ScreenLiveClient” and exposing a rich RAT interface for remote operators.

NPM Supply Chain Attack

The Node.js RAT provides full interactive control over the infected host through WebSocket commands.

The package uses a straightforward typosquatting strategy, impersonating undici, the official HTTP/1.1 and HTTP/2 client bundled with Node.js.

Supported actions include remote shell execution, file upload, multi-monitor screen capture and streaming, microphone recording, webcam enumeration/streaming, and even playing arbitrary audio on the victim’s speakers.

Screen capture is implemented via screenshot-desktop and resized using PowerShell’s System.Drawing APIs before streaming over the RAT channel.

Persistence is implemented in layers to survive reboots and permission failures. The malware first attempts to create a high-privilege scheduled task named “ScreenLiveClient”, then falls back to a HKCU Run key, and finally copies itself into the Windows Startup folder if the other steps fail.

To reassure the user while it runs silently, the malware may display a fake DLL-missing error dialog via VBScript, suggesting the program failed to start, even though the RAT is already active.

The most significant escalation from earlier LofyGang tooling is the native second-stage, chromelevator.exe, downloaded from amoboobs[.]com behind Cloudflare infrastructure.

The Node.js layer attempts to drop this binary into Windows Defender exclusion paths when possible, or into %TEMP%\WinSvcHost as a fallback, then executes it using several strategies to bypass UAC and logging.

JFrog’s analysis shows chromelevator.exe is a 64‑bit Windows PE that performs process hollowing via direct syscalls, allocating memory and spawning remote threads without calling user-mode ntdll APIs.

The very first thing index.js does upon execution is check if it’s already running hidden. If not, it creates a VBScript file to re-launch itself as a windowless process.

This approach is designed to evade EDR products that hook standard Windows APIs, allowing the stealer to inject into browser processes and loot credentials, cookies, credit cards, IBANs, and session tokens at scale.

The binary matches the MAL_Browser_Stealer_Dec25_2 YARA rule from Nextron’s VALHALLA feed, which is associated with the GlassWorm campaign an ongoing multi-ecosystem supply chain operation targeting npm, PyPI, and GitHub.

Once injected, the stealer targets over 50 Chromium and Gecko-based browsers, as well as Safari for Windows, scraping saved credentials and cookies from SQLite databases and local storage.

It similarly targets more than 90 browser wallet extensions and dozens of desktop wallets, attempting even offline password cracking for wallets like Exodus via PBKDF2.

Additional modules hijack sessions for Roblox, Instagram, Spotify, TikTok, Steam, Telegram, and Discord, often enriching tokens with profile and billing metadata from platform APIs.

Exfiltration is deliberately redundant. Smaller datasets and status messages are sent directly to a hardcoded Discord webhook and a Telegram bot, whose URL is constructed via base64 to hinder static detection.

Larger archives, such as Steam or Telegram data and wallet backups, are uploaded to third-party file-sharing services like gofile.io and catbox.moe, with the resulting links shipped back over Discord and Telegram.

Anti‑VM, anti‑debug, and LofyGang

The undicy-http payload invests heavily in staying invisible to analysts and sandboxes. An AntiVM class implements ten distinct checks spanning MAC prefixes, BIOS strings, disk names, analysis tools, usernames, registry keys, services, and known sandbox file paths.

If analysis or deobfuscation is detected, self-referential code and debugger statements can lock tools into infinite loops, further slowing reverse engineering.

Attribution to LofyGang appears robust and marks a notable evolution in their tradecraft. Earlier campaigns largely used JavaScript-based Discord token stealers and credit card harvesters; undicy-http introduces a compiled native injector with syscall-level evasion and a comprehensive, multi-platform data theft stack.

JFrog recommends uninstalling undicy-http immediately, terminating suspicious node and wscript.exe processes, removing the “ScreenLiveClient” scheduled task and Run key, deleting dropped VBScript launchers and chromelevator.exe, and wiping the lofygang-local staging directory.

Combined with the RAT’s live screen and audio streaming and the broad wallet targeting, this makes undicy-http one of the most capable npm-based payloads publicly linked to this actor to date.

The malicious infrastructure centers on the WebSocket C2 at 24[.]152[.]36[.]243:3000 and the payload host amoboobs[.]com (172[.]67[.]173[.]92), alongside official Discord and Telegram APIs abused for exfiltration.

Given the depth of compromise and stealth of the native injector, systems where chromelevator.exe executed should be treated as fully compromised, with full credential rotation, wallet migration, session revocation, and, where possible, complete re-imaging.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.