MALFEX npm Campaign: Eight Malicious Packages, Three Payloads, 14 Months Without an Advisory

The MALFEX npm campaign, disclosed by CloudSEK on September 30, 2026 and detailed by Checkmarx Zero on October 5, 2026, is a set of eight malicious npm packages published by a single operator since August 2023 that deliver the Overlord RAT, the movinlike stealer, or a rotating downloader to Windows systems. Three of the eight were still installable on October 1, 2026, and the largest, function-flag, has carried malicious code for 14 months with no advisory issued against any version.

This post is for anyone running Node.js in a build pipeline or on a Windows developer machine. Below are the affected versions, the three execution paths, the indicators of compromise, the first-hour runbook, and the reason advisory-fed tooling had nothing to match against for more than a year. Written October 2026; registry state changes fast, so recheck package status before acting on the tables.

What Happened: MALFEX, Eight Packages, 40,767 Downloads

The MALFEX npm campaign is eight malicious packages published across five npm accounts (malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4) between August 2023 and September 2026. Together they recorded 40,767 downloads on npm, 37,419 of them on function-flag, with 3,017 in the week to October 1, 2026.

The operator signed the work. The MALFEX name appears in the publisher accounts, in the git author email of the payload repository (corpmalfex[@]gmail.com), in the README of [email protected], which credits the MALFEX team and names its owner, and in the stealer chain's AES key, malfexteam2027. Four more packages from the same accounts carry no malicious code and served as cover: function-ascii, malfapi, malfex-webhook-node, and centralizemiddle. Block those too if you block by publisher.

Download counts measure registry reach, not compromised hosts. No widely used package depends on any MALFEX package, so exposure is limited to systems that installed these names directly, and only Windows hosts run the payloads. The primary sources are the Checkmarx Zero write-up, which carries the full IOC tables, and the CloudSEK disclosure, which first tied the activity to one operator.

How the MALFEX Attack Chain Executes

MALFEX uses three independent delivery paths that share an operator but no infrastructure, so blocking one does nothing to the other two. Two paths fire from npm lifecycle scripts during install. The third fires when the package is required, with no install hook at all, which is the detail that limits what --ignore-scripts can do here.

Path 1: Overlord RAT loaders (tlxbnhd, tldriver, mxdriver)

Obfuscated preinstall.js and postinstall.js scripts run on every npm install, fetch a file served as image/png from api.imghippo.com, write it to the package directory as gldriver_pre_core.exe and gldriver_pre_asset.exe, launch it, then delete themselves. The scripts carry launch commands for macOS and Linux, but the payload is a Windows executable, so only Windows hosts are affected.

The file served as a PNG is a Microsoft IExpress self-extracting archive. Inside sit a legitimately signed AutoIt3 interpreter and an encrypted AutoIt script that peels back XOR-encoded strings, RC4, and LZNT1 compression to produce Overlord RAT. Checkmarx's reading of the script shows Overlord injected into TapiUnattend.exe, a signed Windows binary, through process hollowing with explorer.exe spoofed as the parent. That injection step was established from the code, not observed at runtime.

Overlord RAT has no hardcoded command and control address. The RAT reads encrypted memos the operator posts in Solana transactions, decrypts them, and uses the result as its server list, so a server takedown does not break addressing; a new transaction repoints every infected host. Capabilities include screen capture, keylogging, clipboard capture, file search, remote shell, and a hidden desktop driven by a virtual display driver. The analyzed build had no Solana address configured and no C2 traffic was observed. The same RAT has appeared since July 2026 in the wp2shell WordPress campaign (CVE-2026-63030, CVE-2026-60137) and in a fake Zoom installer campaign on macOS.

Path 2: the movinlike Discord and browser stealer (native-runner, img-to-native, cdn-img-fetch)

None of these three packages has an install hook. The malicious code runs when the package is loaded: img-to-native requires cdn-img-fetch purely to trigger it, and cdn-img-fetch downloads banner.png from raw.githubusercontent.com/cavecrew/proj the moment it is required. native-runner was a wrapper that pulled img-to-native in.

img-to-native waits up to 120 seconds for the image, locates data appended after the PNG end marker, decrypts it with AES using the key malfexteam2027, and writes the result to %APPDATA%\Microsoft\Windows\node_runtime_helper.exe. That Go downloader fetches setup.exe from 104.234.65.75:700, which is movinlike, a 64 MB Node.js stealer packaged as a Windows executable.

movinlike targets eight Discord clients (Discord, Discord Canary, Discord PTB, Discord Development, Lightcord, Vesktop, Nightcord, Bluecord), injects code into each client's startup scripts to steal authentication tokens, then uses those tokens to collect profile details, saved payment sources, subscriptions, servers, friends, and linked accounts. The stealer also takes cookies and saved logins from Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex, copies Telegram Desktop session data from %APPDATA%\Telegram Desktop\tdata, and collects data from MetaMask, Phantom, and Coinbase Wallet extensions as well as desktop wallets. Everything is zipped, split into 25 MB chunks, and posted to a hardcoded Discord webhook created on September 26, 2026 in a newly created server. A Discord token stealer riding in through npm is not new; the require-time trigger is.

Path 3: the function-flag downloader (function-color, function-flag)

function-flag is the longest-running path and the one most teams will find in a lockfile. Each malicious version carries a download routine in index.js that points at a different host. In 1.7.3, the current latest, the postinstall script runs example.js, which calls the package's ASCII art function with the Bloody font. That font value triggers a hidden routine that downloads node.exe from cdnzona.discloud.app, a Brazilian application hosting service, saves it to %APPDATA%\node.exe, and runs it with the window hidden.

Three evasion details matter for detection. The whole routine is wrapped in an empty catch, so a failed download still lets the install complete without an error. process.env.APPDATA is undefined outside Windows, so macOS and Linux fail silently and never show a symptom. And the malicious lines are padded with spaces so they sit past the visible edge of a typical code editor. The operator also published malicious 4.0.0, then shipped a newer malicious build under the lower version number 1.7.3, which defeats any assumption that the latest version is the safe one.

Version 2.3.4 is not malicious. function-color contains no payload of its own and installs function-flag as a dependency. The 1.7.3 host was not responding when Checkmarx checked, so that payload has not been recovered, and nothing found so far links function-flag to movinlike. The postinstall script still attempts the download on every install, and the host can start serving again at any time.

Why MALFEX Matters: A Live Malicious Package With No Advisory for 14 Months

function-flag has been malicious since July 2025, has 37,419 downloads, and as of October 1, 2026 still carries no OSV or npm advisory. The campaign is less notable for its tooling than for how long advisory-driven detection left the largest package untouched.

The behavioral overlap with earlier npm supply chain attacks is plain: lifecycle-script execution, as in the Mini Shai-Hulud compromise of intercom-client and the original Shai-Hulud wave of September 2025; payloads hidden behind image files; Discord webhooks as the exfiltration channel. Three things are new here. Path 2 runs at require time with no install hook, which --ignore-scripts does nothing against. Overlord pulls its C2 from a public blockchain that nobody can take down. And the operator signs the work across five publisher accounts, an email, a key string, and a README, with no attempt to hide.

Attribution stops at the operator's linguistic space. CloudSEK notes the Portuguese-language README, git commits at UTC-3, and a common Brazilian handle, and says plainly that none of this points at Brazilian targets. Delivery is npm and Discord, both global, and the second-stage targeting is opportunistic: anyone who installs the stealer becomes a target.

Six of the eight advisories were issued between September 22 and 30, 2026, three years into the campaign. Tooling that relies only on advisory feeds will miss the two live packages with no advisory and the two unflagged versions of the third.

Indicators of Compromise (IOCs) and Behavioral Signals

Hunt in three places: lockfiles and private registry caches for the eight package names, Windows hosts for the paths and the \Maiden scheduled task, and egress logs for the specific payload URLs. Block the paths, not the shared domains they sit on; api.imghippo.com, raw.githubusercontent.com, discord.com, and onrender.com all carry legitimate traffic.

Package versions to block

Block all eight packages at the registry proxy, including the wrappers. Blocking function-flag alone does not stop function-color, and blocking img-to-native alone does not stop cdn-img-fetch. Every version listed in the first table is malicious except [email protected].

File system indicators (Windows)

SmartScope.vbs builds the string Wscript.Shell by concatenation to dodge scanners that search for CreateObject("Wscript.Shell"). Deleting the npm package does not remove any of these artifacts or the scheduled task.

Network and process indicators

• hxxps://api.imghippo[.]com/files/hOG8244hc.png: Overlord RAT payload served as image/png
• hxxps://raw.githubusercontent[.]com/cavecrew/proj/main/banner.png and banner.jpg: stealer chain payloads
• hxxp://104.234.65[.]75:700/setup.exe and hxxp://104.234.65[.]75/setup.exe: movinlike download. Null-route the IP
• The eight function-flag payload URLs in the version table above
• discord[.]com/api/webhooks/1553545982975811594/...: movinlike exfiltration webhook
• Process: AutoIt3.exe launching from a fake vendor directory; TapiUnattend.exe spawned with explorer.exe as parent

SHA256 hashes

Checkmarx published 19 hashes covering the Overlord loader, the signed AutoIt3 interpreter, the encrypted script, the decoded RAT, the banner images, four stealer chain downloaders, the loader postinstall script, movinlike, and the per-version index.js and example.js files. Copy them from Table 6 of the Checkmarx write-up linked above rather than from a secondary source, and pair hash matching with the behavioral indicators here, since movinlike is trivially rebuilt.

Detection commands

Check the resolved dependency tree, including transitive dependencies:

npm ls function-flag function-color cdn-img-fetch img-to-native native-runner tlxbnhd tldriver mxdriver --all

Search lockfiles, since a malicious version can stay pinned after removal from the registry:

rg -n 'function-flag|function-color|cdn-img-fetch|img-to-native|native-runner|tlxbnhd|tldriver|mxdriver' package-lock.json npm-shrinkwrap.json pnpm-lock.yaml yarn.lock

On Windows hosts, check for the documented artifacts in PowerShell:

Test-Path "$env:LOCALAPPDATA\ScopeSmart Technologies Inc"
Test-Path "$env:APPDATA\Microsoft\Windows\node_runtime_helper.exe"
Test-Path "$env:APPDATA\node.exe"
schtasks /query /tn "\Maiden" /fo LIST /v

Any True result or a matching scheduled task should be treated as a likely infection. Review proxy and DNS logs for the URLs and hosts above.

Immediate Response: The First-Hour Runbook

Treat any Windows host that installed one of the eight packages as compromised, even if node_modules has since been deleted. Isolate first, remove persistence second, rotate from a clean machine third.

1. Isolate the host from the network and preserve logs and filesystem evidence for investigation.
2. Remove persistence: delete the \Maiden scheduled task and remove the ScopeSmart Technologies Inc directory, node_runtime_helper.exe, and %APPDATA%\node.exe if present, keeping forensic copies.
3. Rotate from a known clean system: change Discord credentials, every account with logins saved in the browser, and anything else used on the host. Terminate active Telegram sessions. Move cryptocurrency funds to new wallets.
4. Review account activity: check Discord for unexpected payment activity and other accounts for sign-ins from unfamiliar locations.
5. Purge internal copies: remove all eight packages from private registries, proxies, and caches. A registry takedown does not clear copies already stored internally, and a lockfile can keep a removed version pinned.
6. Freeze publishes from any CI runner or developer machine that installed the packages until credential rotation is complete.

Why Advisory-Fed Scanners Missed function-flag for 14 Months

Tooling that only matches dependency manifests against public advisory feeds had nothing to match: function-flag and function-color have no advisory, and the cdn-img-fetch advisory omits two of its four malicious versions. The package names were unremarkable, the versions were unflagged, and the malicious code sat behind a font parameter padded off the edge of the editor.

The structural point is that an advisory feed is a lagging record of what someone already reported. Six of the eight MALFEX advisories arrived in the last nine days of September 2026, three years after the operator started publishing. Malicious package detection has to work from a package's behavior and provenance (typosquats, dependency confusion, compromised or suspicious packages) rather than wait for a MAL- identifier. Kodem's runtime-powered SCA treats a malicious package as its own finding type, scored at the top of the range by design so it never queues behind a backlog of medium CVEs, and maintains Kodem's own KOD- advisory database alongside NVD and GitHub Advisories rather than depending on public feeds alone.

The second point is that declared is not loaded. A lockfile tells you what was resolved. Runtime intelligence tells you which packages a running workload actually loaded, which is the evidence that turns a lockfile hit into a confirmed yes or a confirmed no for that service. The boundary is worth stating: MALFEX's payloads execute on Windows developer machines, outside the workloads a runtime sensor watches. For a server-side workload, loaded-or-not evidence is the difference between an afternoon of credential rotation and a note that the package resolved but never ran. For the developer laptop, the runbook above is the answer.

Application Detection and Response sits one layer further out, built to surface suspicious runtime behavior and exploit attempts inside running applications. The right framing for MALFEX is narrow: an anomalous child process or an unexpected outbound fetch from a workload is the kind of signal ADR is designed to raise, and it is not a desktop stealer control.

Hardening Your Pipeline Against the Next MALFEX Variant

The operator is still publishing and three packages are still installable, so assume more versions and more wrappers. The fixes below cost an afternoon and hold against the next variant, not only this one. Every one of them is a basic open source security control that most pipelines still skip.

7. Set ignore-scripts=true in .npmrc for CI and developer installs, and know its limit: it stops Paths 1 and 3 but not Path 2, which runs at require time.
8. Enforce lockfiles with npm ci and diff lockfile changes in code review. A new package name or a version that moved downward (4.0.0 to 1.7.3) is a review flag.
9. Put a registry proxy in front of npm with an allowlist and a block list that includes wrapper packages, not only the package carrying the payload.
10. Run malicious package detection on every dependency change in CI, scored separately from CVE findings so a malicious package never waits behind triage.
11. Egress-filter build runners and developer workstations to known destinations. All three MALFEX paths phone out to a short list of hosts.
12. When a package is removed from the registry, review its declared dependencies too. cdn-img-fetch stayed installable after img-to-native, the package that depended on it, was seized.
13. Audit publisher accounts, not only package names. Five accounts carrying the same brand string published this campaign.

What MALFEX Signals About npm Supply Chain Attacks Through 2027

MALFEX is a small, patient, single-operator npm malware campaign that stayed live for three years because nothing in the default npm safety net looks at behavior. The trajectory is more of these, not fewer.

• Require-time triggers will displace install hooks as --ignore-scripts adoption grows. Path 2 is the template.
• Blockchain-addressed C2 moves resilience from infrastructure that can be seized to a public ledger that cannot. Overlord's Solana memos will be copied.
• npm is commodity delivery for commodity stealers. Discord tokens, browser logins, and wallets, with no targeting. Download volume, not victim selection, is the business model.

One falsifiable prediction: by the end of Q1 2027, at least one further function-flag or function-color version ships with a new payload host, and at least one of the three live packages still has no advisory 30 days after this post publishes.

Frequently Asked Questions

The Bottom Line

function-flag sat on npm as a live malicious package for 14 months because the only thing watching it was an advisory feed that had nothing to say. A lockfile hit is a question, not an answer. Malicious package detection that reads behavior and provenance answers the first half; runtime evidence of what a workload actually loaded answers the second. See how Kodem SCA flags malicious packages, or talk to a security engineer about what your lockfiles are resolving right now.

References

1. Checkmarx Zero. October 5, 2026. MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work. Checkmarx.
2. CloudSEK. September 30, 2026. MALFEX: Malicious npm postinstall supply chain campaign. CloudSEK.
3. The Hacker News. October 7, 2026. Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer. The Hacker News.
4. SecurityWeek. October 2026. Long-Running NPM Malware Campaign Accumulates 40,000 Downloads. SecurityWeek.
5. vxaboveground. Overlord RAT source repository. GitHub.
6. Kodem Security. May 1, 2026. Mini Shai-Hulud Strikes PyTorch Lightning and intercom-client. Kodem.