MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data

What it is

MALFEX, a supply-chain campaign tracked by CloudSEK and tied to a single operator (npm accounts containing "Malfex," GitHub handle cavecrew, a name "Murizada" referenced in a README) active since August 2023. CloudSEK assesses the operator is likely Portuguese-speaking based on Portuguese text in a repo and a Brazil-linked GitHub handle, though they stop short of attribution to Brazil.

Preconditions / Affected

At least 12 npm packages and one GitHub repo are linked to the operation. Of the malicious packages, five received npm security advisories, but three — including function-flag and cdn-img-fetch — did not. function-flag stayed live and installable for 14 months. cdn-img-fetch remained available even after npm pulled its parent package img-to-native, and function-color separately pulled in function-flag as a dependency.

How it works

flowchart TD
    A[img-to-native installed] --> B[cdn-img-fetch dependency]
    B --> C[Fetches PNG from GitHub]
    C --> D[Decrypts embedded payload]
    D --> E[Downloads 64MB Node.js bundle]
    E --> F[Injects into Discord client, steals tokens/cookies/wallets/Telegram sessions]
    G[img-to-native removed by npm] -.does NOT remove.-> B

The key structural point: pulling the parent package (img-to-native) did not remove its dependency (cdn-img-fetch), which stayed live and functional independently.

What to do

CloudSEK's stated recommendation: don't treat removal of a single flagged npm package as sufficient — check its connected dependencies and related packages/external payloads, rather than relying only on individual npm security advisories (since 3 of the 8+ identified malicious packages never got one).

Caveats

Attribution (Portuguese-speaking operator, "Murizada") is circumstantial — based on README text and a GitHub handle, not confirmed identity or geography. The page gives no specific remediation commands (e.g., no npm audit command or version pins), only the general dependency-checking guidance above.