Fake npm Install Messages Conceal RAT Malware in New Open Source Supply Chain Attack

ReversingLabs identified the "Ghost" campaign — malicious npm packages that present highly realistic fake npm install logs to lull developers into entering sudo credentials, then download, decrypt and execute a crypto‑stealing RAT. The report lists numerous package names and SHA1 hashes, describes multi‑stage retrieval via attacker‑controlled Telegram/web3 posts, and links the activity to GhostClaw/North Korea‑linked operations; defenders are advised to treat post‑install sudo prompts and post‑install external downloads as suspicious and to use automated supply‑chain security tooling.