MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work

What it is

MALFEX is an npm supply-chain campaign run by a single operator (publisher accounts malfexkkj, malfex_user, malfexteste2/3/4; git email corpmalfex@gmail.com; README credits "Murizada"). Three malicious packages remain live and installable as of 29 September 2026: function-flag, function-color, and cdn-img-fetch. Two of these — function-flag and function-color — have no OSV advisory at all, and the advisory for cdn-img-fetch (MAL-2026-17320, published 30 September) covers only versions 1.0.0/1.0.1, missing the malicious 1.0.2 and 1.0.3. function-flag alone accounts for 37,419 of the campaign's 40,767 total downloads and has been malicious since July 2025.

How it works

flowchart TD
    A[npm install] --> B{Which path?}
    B -->|tlxbnhd/tldriver/mxdriver| C[preinstall/postinstall download PNG-disguised EXE from api.imghippo.com]
    C --> D[IExpress archive: signed AutoIt3 + encrypted Oxygen.a3x]
    D --> E[Overlord RAT injected into TapiUnattend.exe via process hollowing]
    B -->|native-runner/img-to-native/cdn-img-fetch| F[banner.png fetched, AES-decrypted with key malfexteam2027]
    F --> G[Go downloader → movinlike stealer]
    B -->|function-color/function-flag| H[postinstall runs example.js, hidden asciiArt trigger]
    H --> I[downloads node.exe from rotating host per version]

Each of the three delivery paths is independent and shares no infrastructure. The stealer chain (img-to-native/cdn-img-fetch) has no install hook at all — it triggers on require(), so --ignore-scripts does not stop it. function-flag's malicious code is padded with spaces past the visible editor width, wrapped in an empty catch block so failed downloads don't error, and uses process.env.APPDATA as a Windows-only gate. Overlord RAT has no hardcoded C2: it reads encrypted memos from Solana blockchain transactions for its server list, so takedowns don't disable it. Persistence uses a backdated (1/1/2020) scheduled task named \Maiden under a fake "ScopeSmart Technologies Inc" directory — no registry Run keys, so Run-key sweeps miss it.

Preconditions / Affected

Windows only — the Overlord and function-flag paths explicitly fail silently on macOS/Linux. Exposure requires having installed one of the eight named packages directly or transitively (function-color pulls in function-flag; img-to-native pulls in cdn-img-fetch). No legitimate widely-used packages depend on any operator package.

What to do

Check dependency trees and lockfiles:

npm ls function-flag function-color cdn-img-fetch img-to-native \
  native-runner tlxbnhd tldriver mxdriver --all

rg -n 'function-flag|function-color|cdn-img-fetch|img-to-native|native-runner|tlxbnhd|tldriver|mxdriver' \
  package-lock.json npm-shrinkwrap.json pnpm-lock.yaml yarn.lock

Check Windows hosts for artifacts:

Test-Path "$env:LOCALAPPDATA\ScopeSmart Technologies Inc"
Test-Path "$env:APPDATA\Microsoft\Windows\node_runtime_helper.exe"
Test-Path "$env:APPDATA\node.exe"
schtasks /query /tn "\Maiden" /fo LIST /v

If infected: isolate the host, preserve evidence, remove the \Maiden task and the artifacts above, then from a clean system rotate Discord/browser/other credentials, terminate Telegram sessions, and move crypto funds to new wallets. Block all eight packages at the registry proxy (blocking function-flag alone does not stop function-color). Null-route 104.234.65.75 but do not blanket-block discord.com or raw.githubusercontent.com since they're shared services.

Caveats

The process-hollowing injection into TapiUnattend.exe was established from static code analysis, not observed at runtime. The function-flag 1.7.3 payload host (cdnzona.discloud.app) was not responding at time of writing, so that specific payload wasn't recovered, and no link to movinlike was found for it. movinlike can be rebuilt easily, so file-hash matching should be paired with behavioral indicators.