New npm Supply Chain Attack Uses undicy-http to Deploy Screen-Streaming RAT and Browser Injector

A malicious npm package, "undicy-http", impersonating the legitimate Node.js HTTP client "undici", delivers a two-stage attack: a Node.js RAT providing remote shell, screen/microphone/webcam access and persistence, and a native Windows stealer "chromelevator.exe" that injects into browsers to exfiltrate passwords, cookies, session tokens, credit cards, and crypto wallet data. The campaign, attributed to LofyGang, includes anti-analysis and EDR-bypass techniques, uploads exfiltrated data to services (gofile.io, catbox.moe), and uses Discord and Telegram for data exfiltration and command-and-control (C2 IP 24.152.36.243, domain amoboobs.com); remediation steps and YARA rule linkage are provided.