Affected Systems

npm ecosystem; 8 malicious packages (tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, function-flag, function-color, cdn-img-fetch) with 40,767 total downloads since August 2023. Targets Windows systems; deploys Overlord RAT, movinlike stealer (Discord, browsers, Telegram, crypto wallets). Three packages remain live on npm as of disclosure.

Exploitation Status

Active campaign since August 2023. Three packages (function-flag, function-color, cdn-img-fetch) were still live at time of disclosure. Overlord RAT observed in two other active campaigns since July 2026, including WordPress exploitation (CVE-2026-63030, CVE-2026-60137) and macOS fake Zoom installer attacks. Attributed to Portuguese-speaking lone threat actor (handle: Murizada).

Business Impact

Development teams using npm may have unknowingly installed malicious packages, particularly function-flag (37,419 downloads). Compromised Windows developer workstations could expose Discord credentials, browser data, Telegram sessions, and cryptocurrency wallets. RAT deployment enables persistent remote access. Three packages remained available for download at disclosure, indicating ongoing exposure risk. No CVE assigned; detection relies on package name matching and behavioral analysis.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all npm dependencies for the eight malicious packages: tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, function-flag, function-color, cdn-img-fetch. Remove immediately if found.
  • Search developer workstations for indicators: node.exe in %APPDATA%, connections to cdnzona.discloud.app, Overlord RAT Go binaries, and movinlike stealer artifacts.
  • Review npm install logs and CI/CD pipeline histories for downloads of function-flag (especially versions from July 2024 to August 2025) and other flagged packages.
  • Implement npm package integrity checks using lock files, private registries, and tools like Socket or Snyk to block typosquatting and suspicious lifecycle hooks.
  • Rotate credentials for Discord, Telegram, browsers, and cryptocurrency wallets on any system that installed these packages; monitor for unauthorized Solana transactions used by Overlord RAT C2.

---

# Threat Actor Context

Actor Profile

MALFEX is a long-running npm supply chain malware campaign attributed to a lone Portuguese-speaking threat actor operating under the handle "Murizada." Active since August 2023, the actor has published 12 npm packages, eight of which have been confirmed malicious. Attribution indicators include Portuguese-language project descriptions, Git commits timestamped at UTC-0300 (Brazilian timezone), and Brazilian infrastructure usage (discloud.app hosting service). The campaign demonstrates opportunistic targeting through global distribution channels (npm, Discord) rather than geography-specific victim selection. The actor's self-identification in package metadata ("created with a lot of love and dedication by the Malfex team, whose owner is Murizada") suggests low operational security maturity.

TTPs (Tactics, Techniques, Procedures)

The campaign employs npm package typosquatting and dependency confusion for initial access, leveraging lifecycle hooks (postinstall scripts) for execution. Three distinct infection chains are used: (1) Overlord RAT loaders that download Windows executables via lifecycle hooks, (2) a multi-stage chain using cdn-img-fetch to retrieve Go executables that deploy Node.js-based stealers, and (3) downloaders with version-specific remote payload locations. The stealer component (movinlike) targets credential stores including Discord tokens, browser saved credentials, Telegram data, and cryptocurrency wallets. Overlord RAT uses an unusual C2 resolution technique, extracting command-and-control addresses from Solana blockchain transactions. Payloads are hidden using conditional triggers (e.g., ASCII art font parameter "Bloody" in function-flag 1.7.3) and executed with hidden windows (%APPDATA%\node.exe with window concealment).

Targets & Patterns

The campaign primarily targets software developers through compromised npm packages, exploiting the trust model of open-source package ecosystems. The Software Development sector is affected through developer workstations that install malicious dependencies. Targeting is opportunistic and global rather than geographically focused, leveraging npm's worldwide developer base and Discord for data exfiltration. The high download count of function-flag (37,419 of 40,767 total downloads) indicates successful social engineering or SEO optimization to drive package adoption. Victims are Windows users, as all three infection pathways specifically target Windows systems. The stealer's focus on cryptocurrency wallets, Discord tokens, and Telegram data suggests financial motivation and interest in high-value developer accounts that may provide further supply chain access.

Historical Context

MALFEX activity spans from August 2023 to at least August 2025, with function-flag first published in July 2024 and updated through August 2025. Three packages (function-flag, function-color, cdn-img-fetch) remained live on npm as of the October 2026 disclosure. Overlord RAT, the primary payload, has appeared in at least two other campaigns since July 2026: exploitation of WordPress vulnerabilities (CVE-2026-63030 and CVE-2026-60137, wp2shell) and a macOS campaign using fake Zoom installers. The macOS campaign shares tactical overlaps with UNK_DeadDrop, a suspected North Korea-aligned threat cluster, though no direct attribution link to MALFEX is established. The campaign demonstrates evolution in obfuscation techniques, with later versions (function-flag 1.7.3) using hidden conditional triggers rather than direct malicious code in postinstall hooks.

Defensive Recommendations

  • Implement npm package vetting processes including automated static analysis of lifecycle hooks (preinstall, postinstall, preuninstall) before installation in development environments
  • Monitor for suspicious child process creation from Node.js and npm processes, particularly downloads of executables to %APPDATA% directories or execution with hidden window flags
  • Block or alert on outbound connections from developer workstations to Brazilian hosting services (discloud.app) and Solana blockchain API endpoints used for C2 resolution
  • Deploy endpoint detection rules for known MALFEX package names (tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, function-flag, function-color, cdn-img-fetch) and file hashes associated with Overlord RAT and movinlike stealer
  • Enforce least-privilege access for npm package installation and monitor for credential theft indicators targeting Discord tokens, browser credential stores, Telegram data directories, and cryptocurrency wallet files