New Npm 'Ghost Campaign' Uses Fake Install Logs to Hide Malware

A new malicious npm campaign dubbed the "Ghost campaign" was discovered delivering downloader packages that display fake installation logs to trick users into providing sudo credentials; those credentials are then used to decrypt and execute a RAT that steals crypto wallets and sensitive data. Researchers observed multiple similar packages, external payload delivery (Telegram and hidden web3 content), and recommend verifying package authors, monitoring install scripts, using automated scanners, and avoiding entering sudo passwords during installs.