MALFEX: Eight Malicious npm Packages, 40,767 Downloads, and an ASCII Art Font That Drops a RAT

If you run npm install on Windows machines, and especially if anything in your dependency tree touches ASCII art, CDN image helpers or obscure “driver” packages, this one is worth ten minutes of your time.

Researchers at CloudSEK and Checkmarx have detailed a long-running npm supply chain campaign they call MALFEX, as reported by The Hacker News. The packages push information stealers and remote access trojans onto Windows hosts. Collectively, they’ve been downloaded 40,767 times, and three of them were still live at the time of reporting.

What the researchers found

According to the report, the activity is assessed to be the work of a single threat actor who has published 12 packages since August 2023. Eight of those have been flagged as malicious:

• tlxbnhd
• tldriver
• mxdriver
• img-to-native
• native-runner
• function-flag (still live)
• function-color (still live)
• cdn-img-fetch (still live)

The download numbers are lopsided. Of the 40,767 total, 37,419 belong to function-flag, which makes it the main driver of the whole operation. It was first published in July 2024, and its latest version was released on August 4, 2025.

The actor didn’t exactly hide. The package description includes a welcome message in Portuguese saying the project “was created with a lot of love and dedication by the Malfex team, whose owner is Murizada.”

Three ways in

The campaign targets Windows through three separate pathways.

1. Overlord RAT loaders. tlxbnhd, tldriver and mxdriver use npm lifecycle hooks to download and run a Windows executable. That executable loads Overlord, an open-source RAT written in Go. The interesting detail here is that Overlord pulls its command-and-control address out of Solana transactions rather than hardcoding it.

2. A stealer chain. Packages such as img-to-native require cdn-img-fetch, which retrieves and runs a Go executable. That binary then fetches movinlike, a Node.js stealer that goes after Discord, browsers, Telegram and cryptocurrency wallets.

3. A downloader. This is where function-flag comes in. It ships a postinstall hook that runs a JavaScript payload to grab a second-stage payload from a remote server. Per the researchers, each version of the package served its payload from a different location. function-color carries no payload of its own; it just lists function-flag as a dependency, which is enough.

The ASCII art trick

The part I found most clever is how the current version of function-flag hides its trigger. Checkmarx described it this way:

“In 1.7.3, the current latest version, the postinstall script runs example.js, which calls the package’s ASCII art function with the Bloody font. That font value triggers a hidden routine that downloads node.exe from cdnzona.discloud.app, a host on a Brazilian application hosting service, saves it to %APPDATA%\node.exe, and runs it with its window hidden.”

Think about what that looks like to a reviewer skimming the package. A postinstall script that runs an example file demonstrating an ASCII art function is about as boring as it gets. The malicious branch only fires on one specific font argument. And the dropped file is named node.exe, which won’t raise eyebrows on a developer box where Node is installed anyway.

Overlord shows up elsewhere

The report also notes that Overlord has appeared in two other campaigns since July 2026. One involves exploitation of WordPress flaws CVE-2026-63030 and CVE-2026-60137 (dubbed wp2shell). The other is a macOS campaign using a fake Zoom installer to deploy the RAT, and that fake Zoom activity shares tactical overlaps with a suspected North Korea-aligned cluster called UNK_DeadDrop.

I’d be careful not to connect dots that the researchers didn’t connect. Overlord is open source, so seeing it in several unrelated operations is exactly what you’d expect. Nothing in the report ties the MALFEX operator to UNK_DeadDrop.

What attribution does and doesn’t tell you

CloudSEK was refreshingly precise about attribution. They point to a Portuguese-speaking operator, git commits at a -0300 timezone offset, a Portuguese repository description, and a GitHub display name and email that use a common Brazilian handle. But they explicitly said none of this means the campaign targets Brazil:

“The delivery is npm and Discord, both of which are global; the second-stage targeting is opportunistic.”

I appreciate that framing. Language clues tell you something about who’s behind the keyboard, not who’s on the receiving end. If you’re reading this from anywhere in the world and you install npm packages, you’re in scope.

My take

A few things stand out to me.

First, this is a low-sophistication actor by some measures (branding the malware with a team name in the package description is not great opsec), and yet one package racked up over 37,000 downloads. You don’t need a nation-state budget to get meaningful reach on npm.

Second, the dependency trick with function-color is the scary part for defenders. If you only audit the packages you directly chose, you’d miss it. The payload lives one hop away.

Third, the C2-over-Solana approach in Overlord means simple domain blocklists won’t catch every stage of this. The npm-side download hosts can be blocked, but the RAT’s control channel is resolved from blockchain data.

What I’d do this week

These are my recommendations, not steps from the researchers:

• Search your lockfiles. Grep package-lock.json, yarn.lock and pnpm-lock.yaml across your repos for all eight package names above. Remember transitive dependencies; function-color exists precisely to pull in function-flag.
• Check Windows endpoints for %APPDATA%\node.exe. A legitimate Node install doesn’t live there. Treat a hit as a likely compromise.
• Block and hunt for cdnzona.discloud.app in DNS and proxy logs.
• Default to --ignore-scripts in CI, and allowlist the packages that genuinely need install scripts. Every pathway in this campaign relied on lifecycle hooks.
• If you find any of these packages installed, assume credentials are gone. Rotate Discord and Telegram sessions, browser-saved passwords and tokens, and move crypto funds from any wallet that was on the box.
• Be suspicious of tiny utility packages with outsized download counts and vague maintainers. Popularity on npm is not a trust signal on its own.

The broader lesson is one I keep coming back to: an install command runs code from strangers with your privileges. Treat it that way.

Sources

• Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer — The Hacker News, 2026-10-07