SECURITYWEEK reports a long-running NPM supply-chain campaign named MALFEX, which has been delivering malicious packages since August 2023. Checkmarx notes that the actor published 12 packages, of which eight were malicious; five have been removed from the registry, while three remained installable as of 1 October 2026: function-flag, function-color, and cdn-img-fetch.
The campaign has accumulated more than 40,000 downloads, with function-flag alone accounting for over 37,000 downloads and being flagged as malicious only by scrutiny after July 2025. Six OSV advisories cover the malicious packages: tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, and cdn-img-fetch, though the cdn-img-fetch entry covers only two of its four malicious iterations.
The campaign employs three independent delivery paths. First, loaders deliver the Overlord RAT and obfuscated scripts during npm install; the payload is Windows-only, despite cross-platform script execution. The Overlord RAT offers remote control features such as screen capture, keylogging, and remote shell. Second, malicious code executes on package load to drop a Node[.]js info stealer called movinlike, targeting eight Discord clients, seven browsers, and cryptocurrency wallets for data theft.
Third, a persistent downloader exists in each malicious version of function-flag to fetch payloads from alternate locations, with the routine designed to permit installation to complete even if the payload download fails; macOS and Linux installations silently fail, leaving Windows systems exposed. There is no evidence of targeted geographic or organisational focus beyond users who install these packages directly. Practical response should emphasise removing these packages, rotating credentials, and scanning for related artefacts on affected Windows hosts.