Malicious npm Campaign “MALFEX” Delivers RAT and Stealer via Eight Packages with 40,000+ Downloads

What it is

MALFEX, discovered by CloudSEK and Checkmarx: a three-year npm supply-chain campaign (since August 2023) run by a suspected lone Brazilian threat actor who published 12 packages across 5 npm accounts, 8 confirmed malicious. The packages are not dependencies of major npm modules, limiting blast radius to direct installs.

How it works

Postinstall lifecycle hooks trigger payload delivery from rotating remote hosts (defeating static detection), splitting into three independent malware families by package subset:

• Overlord RAT (via tlxbnhd, tldriver, mxdriver): Go-based RAT with screen capture, keylogging, clipboard monitoring, file search, remote shell, and a hidden virtual desktop. Uses a Solana blockchain-based C2 resolver to locate infrastructure, complicating takedown. This same RAT has also surfaced in unrelated campaigns abusing WordPress vulnerabilities and fake Zoom installers.
• movinlike stealer (via img-to-native, cdn-img-fetch): a 64 MB Node.js executable that injects into eight Discord client variants, harvests credentials from seven browsers (Chrome, Edge, Brave, Opera, Vivaldi, Yandex), steals Telegram session data and crypto wallets, and exfiltrates via Discord webhook.
• Downloader payloads (via function-flag, function-color): postinstall scripts that fetch and execute Windows executables from rotating hosts.

Payloads silently fail on non-Windows platforms.

Preconditions / Affected

Only Windows hosts (build machines, CI/CD, dev workstations) that directly installed any of the 8 named packages are at risk; macOS/Linux are unaffected. function-flag alone drew 37,419 of the 40,767+ downloads and has been continuously malicious since July 2025 (14 months) without triggering an npm advisory. As of publication, three packages — function-flag, function-color, cdn-img-fetch — remain live and installable on npm.

What to do

• Audit projects/lockfiles for all eight package names and remove any found.
• Scan Windows machines that installed these packages for host artifacts:
• %LOCALAPPDATA%\ScopeSmart Technologies Inc\AutoIt3.exe
• %APPDATA%\node.exe
• %APPDATA%\Microsoft\Windows\node_runtime_helper.exe
• scheduled task named Maiden (runs every 5 minutes)
• Rotate all credentials accessible from affected machines: Discord tokens, browser-saved passwords, Telegram sessions, crypto wallet keys.

Caveats

Only 6 of the 8 malicious packages have OSV advisories (issued by Amazon Inspector, Sept 22–28, 2026), so SCA tooling keyed to advisories will miss the two without one. The page attributes the campaign to a "suspected" single actor — not confirmed.