MALFEX npm Campaign: 8 Packages Trigger Malware on Install and Require

TL;DR

---

Some malicious npm packages execute when an application imports them, even with postinstall and other lifecycle scripts disabled.
Top-level JavaScript runs the moment code calls require() or import, before invoking any exported functions.
The MALFEX campaign spans both execution models under the same threat actor.

A September 30, 2026 report by CloudSEK linked activity from August 2023 to September 2026 to a single adversary.
A subsequent October 5, 2026 analysis by Checkmarx identified 8 malicious packages out of 12 related packages.

8 Malicious Packages and Their Dependencies

Checkmarx identified the following malicious versions.
This list is a reference during forensic investigation; versions outside this table are not guaranteed to be safe.

Package	Reported malicious versions	Role
tlxbnhd	0.0.1	Fetches Overlord RAT
tldriver	0.0.1	Fetches Overlord RAT
mxdriver	0.0.1, 0.0.2	Fetches Overlord RAT
native-runner	1.0.0–1.0.3	Pulls in img-to-native as a dependency
img-to-native	1.0.0–1.0.3	Decrypts executable hidden inside an image
cdn-img-fetch	1.0.0–1.0.3	Fetches image payload containing malicious data
function-color	1.0.0, 1.7.3	Pulls in function-flag as a dependency
function-flag	1.7.3, 2.3.5–2.3.9, 3.0.0, 4.0.0	Downloads and executes secondary binary

As of October 1, 2026, total downloads across all 8 packages reached 40,767, with function-flag accounting for 37,419.
Because this count includes automated dependency resolution by CI systems and package managers, it is not the exact count of infected machines.

Execution via Install Scripts vs. Package Imports

tlxbnhd, tldriver, and mxdriver fetch Windows executables from preinstall and postinstall scripts executed around package installation time.
CloudSEK documented how these scripts extract an AutoIt runtime and script from PNG image files, and launch the Overlord remote access trojan (RAT) to control the host.

The infostealer movinlike follows a separate chain: native-runner → img-to-native → cdn-img-fetch.
In this chain, image download starts the moment the application imports the package with require().
The decrypted binary extracts another program that steals credentials. CloudSEK reported that target data includes tokens and session credentials from Discord, web browsers, and Telegram.

The function-color → function-flag path downloads an external executable post-installation.
During Checkmarx’s investigation, the distribution server for function-flag 1.7.3 did not respond, and the final payload could not be retrieved.
Whether this path delivers Overlord, movinlike, or an entirely different tool remains unconfirmed.

Checking Execution Paths Beyond Install Scripts

Using npm’s ignore-scripts setting prevents scripts declared in package.json from executing automatically during installation.
However, scripts explicitly run with npm run or npm test still execute. If tests or the application import a malicious package during runtime, top-level code runs unrestricted.

Our previous article on npm install scripts permission controls examined mechanisms to restrict automated execution during install.
Because the img-to-native chain triggers on import, auditing dependencies means checking both declared package names and the application code importing them.

In the earlier ViteVenom incident, the attack initiated when users invoked a bundled CLI.
Teams must account for both actions blocked at install time and actions triggered by runtime imports.

Security Advisories for cdn-img-fetch Updated Post-Disclosure

Checkmarx noted that the initial advisory for cdn-img-fetch listed only versions 1.0.0 and 1.0.1.
However, in OSV advisory MAL-2026-17320 updated on October 8, 2026, version 1.0.3 was added.

Furthermore, the OSV JSON entry includes an affected range starting with introduced: "0" alongside specific version entries.
This range notation indicates that all past versions are affected, as rendered on the OSV web interface.
The absence of 1.0.2 from the explicit version list does not imply that version is benign. Scanner results vary depending on how tools ingest updated feeds and parse affected ranges.

Inspecting Lockfiles and Windows Hosts

Detecting compromised packages requires searching both direct dependencies and transitive dependencies pulled in by upstream packages.
The following command inspects package definitions and lockfiles without installing or running packages. If rg is unavailable, use workspace file search across lockfiles:

rg -n --hidden \
  -g 'package.json' -g 'package-lock.json' -g 'npm-shrinkwrap.json' \
  -g 'pnpm-lock.yaml' -g 'yarn.lock' \
  -g '!node_modules/**' -g '!**/node_modules/**' -g '!.git/**' \
  'tlxbnhd|tldriver|mxdriver|native-runner|img-to-native|cdn-img-fetch|function-color|function-flag' .

For every matched line, verify the resolved version against known malicious releases.
Even if removed from the current working tree, traces may linger in build artifacts, lockfile commit histories, or package manager caches.

If these packages ran on a Windows host, deleting the npm packages leaves host-level modifications intact.
Forensic indicators documented by CloudSEK for the Overlord chain include %LOCALAPPDATA%\ScopeSmart Technologies Inc\AutoIt3.exe and a scheduled task named \Maiden.
Deleting the npm package does not remove executables or scheduled tasks installed on the operating system. Isolate the affected host, conduct a forensic investigation, and rotate exposed credentials (API tokens, session cookies, and passwords) from an uncompromised machine.