MALFEX NPM Malware Campaign Delivers Overlord RAT via Malicious Packages

An ongoing open-source NPM malware campaign known as MALFEX has amassed more than 40,000 downloads since launching in August 2023. Uncovered by security researchers at Checkmarx, the supply chain activity involves a cluster of 12 published packages—eight of which contain malicious code designed to infect Windows endpoints with remote access trojans like Overlord RAT and custom credential stealers.

While npm registry operators have taken down five of the flagrant packages, at least three malicious packages—function-flag, function-color, and cdn-img-fetch—remained active and installable as of October 1. The most widely distributed package, function-flag, accounts for over 37,000 of the total download count alone. Despite its widespread reach and malicious behavior active since July 2025, function-flag lacked public security advisories warning developers of its risk at the time of discovery.

The Mechanics of Open-Source Supply Chain Exploitation

Supply chain attacks targeting package registries like NPM leverage the implicit trust developers place in open-source ecosystems. Attackers publish packages with innocent-sounding functionality—such as helper tools for feature flags (function-flag), color utilities (function-color), or image fetching (cdn-img-fetch)—to lure developers into adding them as direct dependencies or executing them via CLI tools.

A primary risk vector in Node.js package security relies on lifecycle hooks defined in package.json files, such as preinstall, install, or postinstall. These scripts execute shell commands automatically upon package installation without requiring manual confirmation from the user. When developers run npm install <package-name> on a local workstation or CI/CD build runner, arbitrary commands embedded by malicious maintainers immediately initiate background infection sequences before any application code is ever built or executed.

Three Distinct Delivery Paths

Checkmarx identified three independent delivery paths utilized throughout the MALFEX campaign. Although these vectors do not share command-and-control (C2) or payload hosting infrastructure, researcher telemetry links all three directly to the same threat actor.

1. Overlord RAT Loaders: The first delivery path relies on obfuscated Node.js scripts executed during npm install. While the initial installer script runs cross-platform on Windows, macOS, and Linux systems, the final stage payload exclusively targets Windows endpoints. The script drops a loader that executes the Overlord RAT. Overlord is a feature-rich remote access trojan providing operators with keylogging, active window monitoring, screen capture, arbitrary file search, interactive remote shell access, and a hidden desktop (HVNC) to conduct unauthorized actions without alerting the logged-in user.

2. The ‘movinlike’ Information Stealer: The second campaign vector triggers malicious routines when the package is loaded or imported into a running Node.js application. Instead of establishing long-term persistent access, this vector drops a specialized Node.js infostealer dubbed movinlike. The malware systematically scans local file systems to extract sensitive credentials, targeting local storage across eight distinct Discord client builds, seven major web browsers (harvesting saved passwords, session cookies, and autofill data), and local cryptocurrency wallet extensions and software.

3. Silent Downloaders in function-flag: The third delivery mechanism represents the longest-running component of the MALFEX campaign. Each malicious release of function-flag embeds a unique downloader configured to fetch payloads from distinct external URLs. The infection logic is engineered for stealth: if the payload download fails, the overall NPM package installation process still completes successfully without throwing an error or interrupting the developer’s workflow. On macOS and Linux systems, the execution routine fails silently, allowing the package to reside harmlessly in non-targeted environments while actively compromising Windows hosts.

Blast Radius and OSV Advisory Coverage Gaps

Checkmarx observed that no legitimate or widely used open-source packages depend on any of the MALFEX operator packages. This limits the campaign’s overall blast radius: exposure is restricted to systems where a developer or build process explicitly installed one of the specific package names directly. The targeting profile lacks geographic or industry filtering, meaning any system running these packages on Windows becomes an immediate target. In corporate environments, an infected developer workstation serves as an ideal entry point for internal network reconnaissance, local credential harvesting, and lateral movement into sensitive source code repositories.

The campaign also highlights tracking gaps within public vulnerability management ecosystems. Although Open Source Vulnerabilities (OSV) advisories exist for six affected packages—tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, and cdn-img-fetch—coverage remains incomplete. For instance, the OSV entry for cdn-img-fetch only covers two of its four known malicious iterations. Furthermore, function-flag lacked an official OSV or NPM advisory despite driving the vast majority of total campaign downloads.

Remediation and Detection Guidance

Organizations utilizing Node.js development environments should immediately inspect lockfiles and developer hosts for references to the MALFEX package suite.

• Audit Dependency Files: Scan all package-lock.json, yarn.lock, and pnpm-lock.yaml files across local workstations and repositories for function-flag, function-color, cdn-img-fetch, tlxbnhd, tldriver, mxdriver, img-to-native, and native-runner.
• Isolate Compromised Systems: If any listed packages are detected on Windows hosts, isolate the endpoint immediately, terminate active Node.js processes, and assume all credentials stored on the device (browser credentials, Discord session tokens, developer SSH keys, and crypto wallets) are compromised.
• Disable Unnecessary Install Scripts: Mitigate lifecycle script risks by configuring NPM build pipelines and developer workstations to block execution scripts by default using npm config set ignore-scripts true.