Checkmarx and CloudSEK have published research on MALFEX, an npm supply-chain campaign attributed to what appears to be a single operator publishing to the registry since August 2023. Of twelve packages the operator pushed, eight carry malicious code and four serve as benign cover. Together the eight account for 40,767 recorded downloads, and at the time of reporting three were still installable from npm. The campaign targets Windows developer machines and CI runners and delivers three distinct payloads: the open-source Overlord remote access trojan, a Node.js credential stealer tracked as movinlike, and a downloader that pulls a Windows executable disguised as node.exe.

No CVE is assigned. This is malware distribution through the registry, not a flaw in npm itself.

What Happened

The packages abuse two execution points: npm lifecycle scripts at install time, and code that runs when the package is require()d. Researchers describe three separate delivery paths, each built from different package names:

Payload pathPackages
Overlord RAT loadertlxbnhd, tldriver, mxdriver
movinlike Node.js stealer chainnative-runner, img-to-native, cdn-img-fetch
Disguised executable downloaderfunction-flag, function-color (wrapper)

function-flag is the outlier by volume: it alone accounts for 37,419 of the 40,767 downloads. Sources disagree on when it turned malicious. Some date the malicious behavior to July 2025, with the latest version shipping August 4, 2025, while others cite an earlier first publication in July 2024. Registry download counts also include mirrors, scanners and dependency-driven installs, so they overstate real infections.

Technical Details

Overlord RAT path. tlxbnhd, tldriver and mxdriver deploy Overlord, a Go-based RAT with screen capture, keylogging, clipboard monitoring, file search, a remote shell and a hidden virtual desktop. One analysis reports the C2 address is recovered from Solana blockchain transactions, which makes a takedown of a single domain or IP ineffective. The same report says the loader injects the RAT into a legitimate Windows binary through process hollowing, but notes that this was established from code review rather than observed at runtime.

movinlike stealer path. native-runner, img-to-native and cdn-img-fetch form a chain that installs a Node.js stealer aimed at Discord tokens, browser-saved passwords, Telegram sessions and crypto wallets. A later package, imgdecode, was reported hiding a shellcode loader inside a Windows native addon, using an image-decoding facade similar to img-to-native.

Downloader path. function-flag and its wrapper function-color fetch a Windows executable named to resemble node.exe. What that binary ultimately runs is not confirmed in public reporting.

Registry metadata gaps complicate detection. The OpenSSF-style advisory for cdn-img-fetch (MAL-2026-17320) lists versions 1.0.0 and 1.0.1, while Checkmarx identifies 1.0.2 and 1.0.3 as the malicious releases, so tooling keyed to the advisory’s version range can miss the real payload.

Impact

Any Windows developer workstation or build agent that installed one of the eight packages is a candidate for full remote control plus theft of browser-stored credentials and wallet data. Because developer machines commonly hold cloud keys, npm and GitHub tokens and SSH keys, a RAT foothold there is a stepping stone into source repositories and release pipelines. The long dwell time of the campaign, roughly three years, suggests the operator has been refreshing payloads to stay ahead of scanners.

Mitigation

  • Search lockfiles and caches now for tlxbnhd, tldriver, mxdriver, native-runner, img-to-native, cdn-img-fetch, function-flag, function-color and imgdecode, across package-lock.json, yarn.lock, pnpm-lock.yaml and CI caches.
  • Treat any host that installed them as compromised. Rebuild rather than clean, and rotate every credential reachable from it: npm and GitHub tokens, cloud keys, SSH keys, browser-saved passwords and wallet seeds.
  • Hunt for artifacts: unexpected node.exe-named binaries outside Node’s install path, unsigned Go binaries under user profile directories, and outbound traffic to Solana RPC endpoints from developer hosts.
  • Harden installs: use npm ci with --ignore-scripts where builds allow it, enforce a registry proxy with an allowlist, and add a minimum-package-age policy so brand-new or newly-changed packages are quarantined before use.
  • Do not rely on a single advisory feed. Match on package name across all versions until the advisory version ranges are corrected.

References