A long-running malware campaign on npm used malicious packages to infect developers’ Windows systems and has racked up more than 40,000 downloads since 2023. Checkmarx says the MALFEX campaign published 12 packages, eight of them malicious, including function-flag, function-color, and cdn-img-fetch, with some still available as of October 1. Delivery paths included install-time scripts and package-load execution that dropped the Overlord remote-access trojan and the movinlike infostealer, which targets Discord clients, browsers, and cryptocurrency wallets.
Why it matters: Developers and organizations that install npm packages directly could still be exposed if these names are present in projects or build systems. This is a supply-chain threat with live malicious packages, so teams should audit dependencies, block the listed packages, and check Windows developer machines and continuous integration systems for signs of compromise.
Ionut Arghire
2026.10.06
100% relevant
This article establishes a distinct, named npm supply-chain campaign (MALFEX) with its own package set, malware families, timeline, and download counts, rather than updating one of the already tracked npm compromise stories.
← Back to all stories