levex-refa
levex-refa is a malicious npm package used in the Contagious Trader campaign, a large cryptocurrency-themed malware operation assessed with high confidence as linked to North Korea and overlapping with Lazarus/FAMOUS CHOLLIMA tradecraft. It was distributed as a dependency of the typosquatted package ts-bign and appeared in malicious GitHub trading-bot repositories, including hijacked dev-protocol Polymarket bot projects. The package is described as an SSH implant malware component.
Observed behavior includes collecting the victim’s local IP address and recursively searching the current working directory for sensitive files, specifically including .env and *.env files, id.json, config.toml, and Config.toml. It then exfiltrates each discovered file to attacker-controlled command-and-control infrastructure via POST requests. Reported exfiltration infrastructure for levex-refa is https://cloudflareguard.vercel.app/api/v1. Related campaign infrastructure also used Vercel-hosted domains named to resemble Cloudflare services.
The malware was delivered through npm dependency chains in fake cryptocurrency trading bot projects themed around Polymarket and similar platforms, targeting cryptocurrency users and likely seeking wallet keys, secrets, and other sensitive configuration data. In the broader campaign context, associated malicious packages also fingerprinted victims via api.ipify.org and, on Linux systems, enabled SSH access by modifying ~/.ssh/authorized_keys and allowing inbound SSH on port 22, though the provided content attributes the recursive file theft behavior specifically to levex-refa. StepSecurity flagged levex-refa@1.0.0 as Critical risk.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
the figure below displays a emailinator inbox from npm user l.os.t.k.yl.e184 , who published ts-bign (benign intermediary) and levex-refa (SSH implant malware)
the figure below displays a emailinator inbox from npm user l.os.t.k.yl.e184 , who published ts-bign (benign intermediary) and levex-refa (SSH implant malware)
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
2 techniques
Execution
Persistence
3 techniques
Persistence
On Linux systems, it creates a backdoor by appending an SSH public key to the user’s ~/.ssh/authorized_keys file.
Privilege Escalation
3 techniques
Privilege Escalation
On Linux systems, it creates a backdoor by appending an SSH public key to the user’s ~/.ssh/authorized_keys file.
Stealth
2 techniques
Stealth
The following other trading themed repositories implement similar encoded exfiltration endpoint implementations ... Base64-encoded exfiltration endpoint ... Some trading bots utilise a really neat method to exfiltrate data with some good misdirection to evade a cursory glance.
The malware uses two Vercel-hosted endpoints, both named to impersonate Cloudflare services: cloudflareguard.vercel.app ... cloudflareinsights.vercel.app ... The naming strategy is deliberate: both cloudflareguard and cloudflareinsights are plausible Cloudflare service names.
Discovery
3 techniques
Discovery
Collection
1 technique
Collection
Command and Control
1 technique
Command and Control
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
SSH implant malware delivered as an npm package in the Contagious Trader campaign, using cloudflareguard.vercel[.]app for exfiltration/staging.
Obfuscated npm malware that steals sensitive files such as wallet keys and configuration files, fingerprints the victim host, and exfiltrates data to attacker-controlled infrastructure.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.