Eight malicious npm packages with 40,767 total downloads installed the Overlord remote access trojan and a Node.js information stealer on Windows machines in a long-running supply chain campaign tracked as MALFEX. The activity has been active since August 2023, and three of the eight flagged packages were still live on the registry at the time of disclosure, giving defenders a concrete list of names to block and a clear picture of how the attack chain is wired together.
What is the MALFEX npm campaign?
MALFEX is a supply chain operation on the npm registry that delivers malware to Windows systems through typosquatted and utility-styled JavaScript packages. Researchers at CloudSEK and Checkmarx assessed the activity as the work of a lone threat actor who published 12 packages since August 2023, with eight of them confirmed as malicious. The campaign name combines the first letters of the two firms that exposed it.
The two firms described the operator as Portuguese-speaking, with git commits timestamped in the UTC-0300 offset used in Brazil, a Portuguese-language project description, and a GitHub display name and email tied to a common Brazilian handle. They stressed that these are attribution clues about the operator, not evidence that the campaign targets Brazilian users, since the delivery channels (npm and Discord) are global and the second-stage targeting appears opportunistic.
Which npm packages were flagged?
The eight malicious packages, by name, are:
- tlxbnhd
- tldriver
- mxdriver
- img-to-native
- native-runner
- function-flag (still live at disclosure)
- function-color (still live at disclosure)
- cdn-img-fetch (still live at disclosure)
Together these packages were downloaded 40,767 times. The bulk of that figure, 37,419 downloads, came from function-flag, which was first published in July 2024 and whose latest version was released on August 4, 2025. The project description on npm carried a Portuguese welcome message crediting the Malfex team and identifying the owner as Murizada.
How does the attack chain work on Windows?
The campaign reaches Windows machines through three separate execution paths that all start from a package install hook:
- Overlord RAT loader. tlxbnhd, tldriver, and mxdriver act as loaders. A lifecycle hook on the package downloads and runs a Windows executable that installs Overlord, an open-source RAT written in Go. Overlord uses Solana blockchain transactions to retrieve its command-and-control address, a method that makes the C2 infrastructure harder to take down.
- Node.js stealer chain. img-to-native requires cdn-img-fetch, which retrieves and runs a Go executable. That binary then fetches a Node.js stealer, tracked by the researchers as movinlike, that targets Discord tokens, browser data, Telegram sessions, and cryptocurrency wallets.
- Postinstall downloader. function-flag contains a postinstall hook that runs a JavaScript payload to download a second-stage file from a remote server. Each version of the package has been found to fetch its payload from a different location.
The function-color package does not embed a payload itself but lists function-flag as a dependency, so installing function-color pulls the malicious function-flag in transit. In version 1.7.3, the latest at disclosure, the postinstall script runs example.js and calls an ASCII art function with a value set to the Bloody font. That font name triggers a hidden routine that downloads node.exe from cdnzona.discloud.app, a host on a Brazilian application hosting service, drops it at %APPDATA%\node.exe, and launches it with the window hidden from the user.
Where else has Overlord RAT shown up?
Overlord has been observed in two other campaigns since July 2026, indicating that the malware is being shared or reused across operators:
- A WordPress exploitation chain that uses the flaws tracked as CVE-2026-63030 and CVE-2026-60137, also referred to as wp2shell, to plant the RAT on compromised sites.
- A macOS campaign in which a fake Zoom installer drops Overlord on Apple systems.
The fake Zoom installer campaign shares tactical overlap with a suspected North Korea-aligned threat cluster dubbed UNK_DeadDrop, though the two npm campaigns themselves are tied to a Portuguese-speaking operator rather than to that North Korea-aligned activity.
What should defenders do with this?
Teams running internal or production Node.js builds have a short, named list to act on. The eight package names above are concrete indicators to block at the proxy, scan for in lockfile diffs, and add to allowlist or denylist rules in package manager policies. Because three of the packages, function-flag, function-color, and cdn-img-fetch, were still live on the registry at disclosure, the registry, not just a cached advisory, is the source of truth for whether a given project remains exposed.
The postinstall hook pattern, in which a seemingly benign utility package runs a script on install, is the common thread. Reviewing postinstall scripts in CI pipelines and pinning packages to known-good versions both reduce the blast radius of this style of attack. Because Overlord retrieves its C2 address from Solana transactions, blocking the malware at the network layer also requires watching for outbound traffic to Solana RPC endpoints from servers that should not be making such calls, rather than relying on a static list of C2 domains.
FAQ
What is the MALFEX npm malware campaign?
MALFEX is a supply chain operation on the npm package registry in which a lone threat actor published 12 packages since August 2023, eight of them confirmed malicious, that install the Overlord remote access trojan and a Node.js information stealer on Windows machines. The campaign was disclosed by CloudSEK and Checkmarx.
Which npm packages were used in the MALFEX campaign?
The eight flagged packages are tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, function-flag, function-color, and cdn-img-fetch. They were downloaded a combined 40,767 times, with function-flag accounting for 37,419 of those downloads. function-flag, function-color, and cdn-img-fetch were still live on the registry at the time of disclosure.
How does the MALFEX attack chain reach Windows?
Three of the packages load the Overlord RAT through lifecycle hooks that run a Windows executable, two of the packages chain together to fetch a Go binary that drops a Node.js stealer called movinlike, and function-flag uses a postinstall hook to download a second-stage payload from a remote server, with each version of the package using a different download location. function-color reaches the same payload indirectly by listing function-flag as a dependency.