Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

Security teams at CloudSEK and Checkmarx have uncovered a supply-chain operation, dubbed MALFEX, built around a dozen npm packages published since August 2023 by what appears to be a single operator. Eight of those packages — including tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, function-flag, function-color and cdn-img-fetch — were found to be malicious and have racked up 40,767 total downloads, with function-flag alone accounting for 37,419 of them. Depending on the package, victims on Windows end up with a loader for the Go-based Overlord RAT (which hides its C2 address inside Solana blockchain transactions), a Node.js stealer called movinlike that grabs data from Discord, browsers, Telegram and crypto wallets, or a downloader chain that fetches a Go binary before dropping the stealer; three packages (function-flag, function-color, cdn-img-fetch) remain published on npm. Researchers note Overlord RAT has also surfaced in a WordPress exploitation wave tied to CVE-2026-63030 and CVE-2026-60137, and in a fake-Zoom-installer campaign on macOS linked to tactics resembling the North Korea-aligned cluster UNK_DeadDrop, though the npm operator is believed to be a separate, Portuguese-speaking individual likely based in Brazil.