Long-Running NPM Malware Campaign Accumulates 40,000 Downloads

The MALFEX campaign is not a new disclosure; it is a three-year npm supply chain operation running since August 2023 that Checkmarx documented on October 5, 2026, the day before this story broke. The mechanism is precise: the actor published 12 packages, eight malicious, using three independent delivery paths with no shared infrastructure. The loaders execute during npm install via obfuscated scripts that run cross-platform but only activate on Windows, delivering the Overlord RAT, infostealers, and additional payloads. As of October 1, three malicious packages remained installable: function-flag (over 37,000 downloads since July 2025, unflagged by any advisory), function-color, and cdn-img-fetch. OSV advisories cover only six malicious packages, and the entry for cdn-img-fetch misses two of its four malicious iterations, so registry hygiene alone is insufficient.

What makes this story defensible is the exposure gap: 40,000 downloads across a campaign with zero CVEs, no CISA KEV entry, and no advisory for the highest-download package. Any organization pulling npm dependencies without pinning hashes or scanning post-install scripts is exposed, and the three active packages mean the infection chain is still open. The independent infrastructure paths also indicate a deliberate operational design rather than opportunistic typosquatting, which raises the likelihood of sustained targeting rather than a one-time spray. Most supply chain stories today describe removed packages or patched registry entries; this one describes active, unpatched, unadvised malware still available for installation.

Defenders should audit dependency trees for the six named malicious packages (tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, cdn-img-fetch) and specifically for function-flag, function-color, and the latest iterations of cdn-img-fetch. Hunt for Overlord RAT telemetry and infostealer dropper artifacts in npm install logs and Windows process creation events; the event list references cross-platform script execution with a Windows-only payload, so Linux and macOS hosts should also review install-time script execution for anomalous child processes. Network restrictions on npm registry access should include dependency-scanning gates that flag any package without an OSV advisory but with high install counts or recent malicious iterations.

Watch for removal of the remaining three packages or publication of additional OSV advisories covering the missing iterations of cdn-img-fetch; either event would change the exposure assessment. A Checkmarx follow-up identifying the actor's signing patterns or linking the three delivery paths to common command-and-control infrastructure would also shift the threat rating from independent campaigns to a unified adversary with centralized control.