Long-Running NPM Malware Campaign Accumulates 40,000 Downloads

The MALFEX campaign involves a threat actor publishing 12 NPM packages since August 2023, eight of which are malicious. Five malicious packages have been removed, but three remain installable as of October 1, 2026, including function-flag, function-color, and cdn-img-fetch. The campaign uses three independent delivery methods: loaders for the Overlord RAT with obfuscated scripts executed during npm install (payload active on Windows only), malicious code dropping the Node.js information stealer 'movinlike' targeting Discord clients, browsers, and crypto wallets, and a downloader in function-flag fetching payloads from different locations. The infection routines allow package installation to complete even if payload download fails and fail silently on macOS and Linux. No legitimate packages depend on these malicious packages, so exposure is limited to direct installations. No geographic or organizational targeting has been identified.

The campaign enables attackers to remotely monitor and control infected Windows systems via the Overlord RAT, including screen capture, keylogging, remote shell access, and stealthy desktop control. The information stealer targets multiple Discord clients, popular browsers, and cryptocurrency wallets, potentially leading to credential and asset theft. The malware affects only Windows systems where the malicious packages are directly installed. The campaign has resulted in over 40,000 downloads of malicious packages, with one package alone having over 37,000 downloads without being flagged by advisories. The silent failure on non-Windows systems limits impact to Windows users.

Five of the eight malicious packages have been removed from the NPM registry, but three remain installable as of October 1, 2026. Users should avoid installing the packages function-flag, function-color, and cdn-img-fetch. Since no legitimate packages depend on these malicious packages, exposure is limited to direct installations. Users and organizations should audit their dependencies to ensure these packages are not present. Monitor vendor advisories such as Open Source Vulnerabilities (OSV) for updates on affected packages. Patch status is not applicable as this is a malware campaign involving malicious packages rather than a software vulnerability.