MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work

MALFEX is an npm supply-chain malware campaign linked to what appears to be a single adversary who has been publishing to the registry since August 2023. As of this writing, the adversary has published twelve packages, eight of them malicious. The attack delivers malware to Windows systems through three separate paths: a loader for Overlord Remote Access Trojan (RAT) (an open-source remote access trojan written in Go); a chain that installs movinlike (a Node.js stealer targeting Discord, browsers, Telegram, and cryptocurrency wallets); and a long-running downloader hidden inside function-flag.

As of 29 September 2026, three malicious packages remained live and installable on npm: function-flag, function-color, and cdn-img-fetch. function-flag and function-color still have no advisory, and the advisory published for cdn-img-fetch on September 30 covers only two of its four malicious versions. function-flag alone has been malicious since July 2025 and accounts for 37,419 of the campaign’s 40,767 recorded downloads.

TL;DR

• Campaign: MALFEX, a malicious package campaign run by a single operator on npm
• Operator activity: 6 August 2023 to present
• Packages: 12 tied to the operator; eight malicious and four benign cover packages
• Still installable (1 Oct 2026): function-flag, function-color, cdn-img-fetch
• Removed: tlxbnhd, tldriver, mxdriver (unpublished); img-to-native, native-runner (seized by npm)
• Downloads: 40,767 across the malicious packages, 3,017 in the past week (npm statistics, 1 October 2026)
• Execution: npm preinstall and postinstall scripts, and code that runs when a package is loaded
• Payloads: Overlord RAT; the movinlike stealer; an unrecovered node.exe from function-flag
• Platform: Windows
• Advisories: Open Source Vulnerabilities (OSV) entries for the five removed packages, plus MAL-2026-17320 for cdn-img-fetch 1.0.0 and 1.0.1. None for function-flag, function-color, or cdn-img-fetch 1.0.2 and 1.0.3
• Immediate action: Block all eight malicious packages. If one was installed on Windows, isolate the host, remove persistence, and rotate exposed credentials from a clean system.

Severity and advisory status

Six of the eight malicious packages carry OSV malware advisories, issued between 22 and 30 September 2026. Coverage is incomplete in two ways. function-flag and function-color have no advisory at all, and the cdn-img-fetch advisory (MAL-2026-17320, published 30 September) lists only versions 1.0.0 and 1.0.1, not the malicious 1.0.2 and 1.0.3. Tooling that relies only on advisory feeds will miss them.

Table 1. Advisory coverage for the malicious MALFEX packages.

Affected packages and versions

Table 2. Malicious packages attributed to the operator.

The operator also published four packages with no malicious code, used as cover: function-ascii, malfapi, malfex-webhook-node, and centralizemiddle.

The operator signs their own work

The campaign is named after the operator’s own branding. The MALFEX name appears across five npm publisher accounts (malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4), in the git author email of the payload repository (corpmalfex[@]gmail.com), and in the README of [email protected], which credits the MALFEX team and names its owner as Murizada. The stealer chain’s decryption key is the string malfexteam2027.

How the malware executes

The campaign uses three independent delivery paths. They appear to share a threat actor but do not share infrastructure, so blocking one pathway does not affect the others.

Path 1: Overlord RAT loaders: tlxbnhd, tldriver, mxdriver

• Windows executable served as image/png
• IExpress archive: signed AutoIt3.exe + encrypted Oxygen.a3x
• Overlord RAT

Each of the three packages works on its own. Obfuscated preinstall.js and postinstall.js scripts run during every npm install, download the payload from api.imghippo.com, save it as gldriver_pre_core.exe and gldriver_pre_asset.exe, launch it, and then delete themselves. The scripts include launch commands for macOS and Linux, but the payload is a Windows executable, so only Windows systems are affected.

Although it is served as a PNG, the file is a Microsoft IExpress self-extracting archive. It contains a legitimately signed AutoIt3 interpreter and an encrypted AutoIt script. The script decrypts its embedded payload through several layers (XOR-encoded strings, RC4, and LZNT1 compression) to produce Overlord RAT. Based on our analysis of the script, it then injects Overlord into TapiUnattend.exe, a signed Windows binary, using process hollowing with the parent process spoofed as explorer.exe. We established this step from the code rather than observing it at runtime.

Path 2: Discord and browser stealer

native-runner → img-to-native → cdn-img-fetch

• banner.png from raw[.]githubusercontent[.]com/cavecrew/proj
• encrypted executable hidden after the PNG data
• Go downloader → movinlike (64 MB Node.js stealer)

None of these packages has an install hook. The malicious code runs when the package is loaded: img-to-native requires cdn-img-fetch purely to trigger it, and cdn-img-fetch downloads banner.png as soon as it is required. native-runner was a wrapper that pulled in img-to-native.

img-to-native waits up to 120 seconds for the image, locates data appended after the PNG end marker, and decrypts it with the Advanced Encryption Standard (AES), using the key malfexteam2027. The output is written to %APPDATA%\Microsoft\Windows\node_runtime_helper.exe. That Go executable downloads setup.exe from 104[.]234.65.75:700, which is movinlike, a Node.js stealer packaged as a Windows executable.

Path 3: function-flag downloader

function-color → function-flag

• postinstall: node example.js
• asciiArt(“oi”, “Bloody”)
• payload downloaded and executed (node.exe in 1.7.3)

function-flag is a separate downloader and the longest-running part of the campaign. Each malicious version carries a download routine in index.js, and each fetches its payload from a different URL (Table 3). In 1.7.3, the current latest version, the postinstall script runs example.js, which calls the package’s ASCII art function with the Bloody font. That font value triggers a hidden routine that downloads node.exe from cdnzona.discloud.app, a host on a Brazilian application hosting service, saves it to %APPDATA%\node.exe, and runs it with its window hidden.

Each malicious version of function-flag downloads its payload from a different location:

Table 3. Payload URLs in each malicious version of function-flag. Version 2.3.4 is not malicious. The 3.0.0 URL is truncated in the available data.

The index.js of version 1.7.3 is shown below, with the space padding collapsed and the URL defanged:

Two further details are visible in the code. The entire routine is wrapped in an empty catch, so if the download fails, as it does while the host is offline, the install still completes without any error. And because process.env.APPDATA is undefined outside Windows, the routine fails silently on macOS and Linux, which is why only Windows systems are affected.

The malicious lines are padded with spaces so they sit past the visible edge of a typical code editor. And after publishing the malicious 4.0.0, the operator published a newer malicious build under the lower version number 1.7.3.

function-color contains no payload of its own and installs function-flag as a dependency. The 1.7.3 download host is not currently responding, so its payload has not been recovered, and nothing we have found so far links function-flag to movinlike. The postinstall script still runs on every install.

Persistence

For the Overlord RAT path, the loader copies itself into a fake vendor directory and registers a scheduled task:

%LOCALAPPDATA%\ScopeSmart Technologies Inc\AutoIt3.exe
%LOCALAPPDATA%\ScopeSmart Technologies Inc\h.a3x
%LOCALAPPDATA%\ScopeSmart Technologies Inc\SmartScope.vbs
 
TaskName:     \Maiden
Task To Run:  "AutoIt3.exe" "h.a3x"
Repeat:       every 5 minutes, no end time
Start Date:   1/1/2020  (backdated)
Author:       Welcome
Comment:      Wichita

ScopeSmart Technologies Inc is not a real company. The task is backdated to 2020 so it does not appear among recently created tasks. No registry Run keys are used, so a Run-key sweep will miss this infection. SmartScope.vbs builds the string "Wscript."+"Shell" by concatenation to avoid scanners that search for CreateObject("Wscript.Shell").

Command and control and data theft

Overlord RAT reads its C2 from the Solana blockchain

Overlord has no hardcoded command and control (Command and Control (C2)) address. It can read encrypted memos that the operator posts in Solana transactions, decrypt them, and use the result as its server list. Changing servers only requires publishing a new transaction, so taking down a server does not disable the addressing scheme. The analyzed build had no Solana address or server list configured, and we observed no C2 traffic during testing.

Overlord focuses on monitoring and control rather than bulk credential theft. Its capabilities include screen capture, keylogging, clipboard capture, active window monitoring, file search, remote shell access, and a hidden desktop that uses a virtual display driver so the operator can work on the machine without the user seeing it.

movinlike exfiltrates to a Discord webhook

movinlike targets eight Discord clients: Discord, Discord Canary, Discord PTB, Discord Development, Lightcord, Vesktop, Nightcord, and Bluecord. It injects code into the client’s startup scripts to steal authentication tokens, then uses them to collect profile details, saved payment sources, subscriptions, servers, friends, and linked accounts.

It also steals cookies and saved login data from Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, and Yandex; copies Telegram Desktop session data from %APPDATA%\Telegram Desktop\tdata; and collects data from cryptocurrency wallet extensions such as MetaMask, Phantom, and Coinbase Wallet, as well as desktop wallets. Everything is zipped, split into 25 MB chunks, and posted to a hardcoded Discord webhook. We confirmed the webhook was live; it was created on 26 September 2026 in a newly created Discord server.

function-flag rotates its payload hosts

Each malicious version points to a different URL, with filenames including node.exe, svchost.exe, nocry.exe, and malfex.exe. Several of the URLs follow Discord’s attachment path format, and the 3.0.0 URL routes a cdn[.]discordapp.com attachment link through a proxy. The 1.7.3 host, cdnzona[.]discloud.app, is not currently responding. The 1.7.3 postinstall script still attempts the download on every install, and the host could start serving a payload again at any time.

Impact and blast radius

npm recorded the following download counts for the malicious packages:

Table 4. Source: npm public download statistics, as of 1 October 2026.

These figures measure registry reach, not compromised hosts. Some function-flag downloads come through function-color, which installs it as a dependency, and a download does not confirm the package was installed on a Windows system.

No legitimate or widely used packages depend on any operator package, so exposure is limited to systems that installed these package names directly. We found no geographic or organizational targeting; anyone who installs the stealer becomes a target.

What is confirmed: eight packages with malicious code were published to npm; three remained installable as of 29 September 2026, two of them with no advisory; and the payload infrastructure was live when we checked, including the Overlord payload URL, the GitHub payload, the setup.exe server, and the Discord webhook.

Indicators of compromise

URLs and hosts

Table 5. api.imghippo.com, raw.githubusercontent.com, discord.com, and onrender.com are shared services; block the specific paths, not the domains.

File hashes (SHA256)

Table 6. movinlike can be rebuilt easily, so pair hash matching with the behavioral indicators below.

Host artifacts

Table 7. Host paths associated with the campaign.

How to detect exposure

Check the resolved dependency tree, including transitive dependencies:

npm ls function-flag function-color cdn-img-fetch img-to-native \
  native-runner tlxbnhd tldriver mxdriver --all

Search lockfiles, since a malicious version can stay pinned after it is removed from the registry:

rg -n 'function-flag|function-color|cdn-img-fetch|img-to-native|native-runner|tlxbnhd|tldriver|mxdriver' \
  package-lock.json npm-shrinkwrap.json pnpm-lock.yaml yarn.lock

On Windows hosts, check for the documented host artifacts in PowerShell:

Test-Path "$env:LOCALAPPDATA\ScopeSmart Technologies Inc"
Test-Path "$env:APPDATA\Microsoft\Windows\node_runtime_helper.exe"
Test-Path "$env:APPDATA\node.exe"
schtasks /query /tn "\Maiden" /fo LIST /v

Any True result or a matching scheduled task should be treated as a likely infection. Also review proxy and DNS logs for connections to the URLs and hosts in Table 5.

Remediation

If an affected package was installed on Windows

Treat the host as compromised, even if node_modules has since been deleted.

1. Isolate the host from the network and preserve logs and filesystem evidence for investigation.
2. Delete the \Maiden scheduled task and remove the ScopeSmart Technologies Inc directory, node_runtime_helper.exe, and %APPDATA%\node.exe if present, keeping a forensic copy.
3. From a known clean system, change passwords for Discord, accounts with credentials saved in the browser, and any other accounts used on the host. Terminate active Telegram sessions and move cryptocurrency funds to new wallets.
4. Review Discord accounts for unexpected payment activity, and review other accounts for sign-in activity from unfamiliar locations.
5. Purge the affected packages from private registries, proxies, and caches. A registry takedown does not remove copies already stored internally.

Block the campaign

• Block all eight malicious packages at your registry proxy, including the wrappers. Blocking function-flag alone does not stop function-color, and blocking img-to-native alone does not stop cdn-img-fetch.
• Deny outbound traffic to the specific URLs in Table 5. Null-route 104.234.65.75, but do not blanket-block discord.com or raw.githubusercontent.com.
• Do not rely on --ignore-scripts alone. It stops the Overlord RAT loaders and function-flag, but the stealer chain has no install hook and runs when the package is loaded.
• When a package is removed from the registry, review its declared dependencies too. cdn-img-fetch stayed installable after img-to-native, the package that depends on it, was seized.

Incident timeline