I have an SXT Lite5 that was just recently installed to link me onto a rural WISP that was replacing a NanoM5 so I'm not too familiar with RouterOS. This device is blocked from external internet access so I can't use any auto-update features.

I took a look at https://wiki.mikrotik.com/wiki/Manual:U ... g_RouterOS for upgrading, but this page is outdated and has incomplete directions.

I'm on 6.40.1 and I want to get to 6.40.4 to get the patch for the KRACK WPA2 vulnerability.

Do I download just the 'Main Package' or do I download 'Extra Packages' or do I download both?

If I use Extra Pacakges do I upload the whole .zip file? Or do I need to extract it and upload all the individual .npk files?

Just download 'Main package', transfer to device, reboot device.

Make sure to download proper architecture, the 'System > Packages' table will tell you yours.
(for SXT, it's mipsbe)