Cybersecurity
Malicious npm packages delivered Overlord RAT and stealer
CloudSEK and Checkmarx said a campaign they called MALFEX used npm packages to spread Overlord RAT, a Node.js stealer and a downloader, with one package driving most downloads.
- CloudSEK and Checkmarx said the MALFEX campaign involved 12 npm packages published since August 2023, and eight had been flagged as malicious.
- They said the packages had been downloaded 40,767 times in total, with function-flag accounting for 37,419 of those downloads.
- Three packages, tlxbnhd, tldriver and mxdriver, acted as loaders for Overlord RAT, while another chain used img-to-native and cdn-img-fetch to retrieve a Go executable that led to movinlike.
- Checkmarx said function-flag 1.7.3 used a hidden routine to fetch node.exe from cdnzona.discloud.app, save it under %APPDATA% and run it without a visible window.
- CloudSEK said the operator appeared Portuguese-speaking, but it said that alone did not show the campaign was aimed at Brazil.
CloudSEK and Checkmarx said the campaign they called MALFEX involved 12 npm packages published since August 2023. They said eight of those packages had been marked as malicious and that the activity appeared to come from a single actor.
The packages had been downloaded 40,767 times altogether. CloudSEK said function-flag was responsible for 37,419 of those downloads, and that the package first appeared in July 2024 before a release on 4 August 2025.
Three packages, tlxbnhd, tldriver and mxdriver, were used as loaders for Overlord RAT. The code path used lifecycle hooks to drop and run a Windows executable, while another set, including img-to-native, relied on cdn-img-fetch to pull down a Go binary that then fetched movinlike.
function-flag used a postinstall step that ran JavaScript to reach out for a payload, and Checkmarx said each version pointed to a different server. In version 1.7.3, it said a hidden routine fetched node.exe from cdnzona.discloud.app, stored it in %APPDATA% and launched it with its window concealed.
CloudSEK said the operator looked Portuguese-speaking, citing commit timestamps, a Portuguese repository description and GitHub details that matched a Brazilian handle. It said that was attribution to the operator’s own language space rather than proof of Brazilian targeting.
Named in this story
Companies
- CloudSEK
- said the campaign was MALFEX and assessed one operator
- Checkmarx
- co-reported the package behaviour and described the hidden payloads
Products and systems
- MALFEX
- the codename CloudSEK and Checkmarx used for the campaign
- Overlord RAT
- the open-source remote access trojan delivered by several loaders
- movinlike
- the Node.js stealer installed by one delivery chain
- function-flag
- an npm package that used a postinstall hook to fetch payloads
- function-color
- an npm package that depended on function-flag
- cdn-img-fetch
- an npm package used to retrieve a Go executable
- img-to-native
- an npm package in the second malware chain
- tlxbnhd
- one of three npm packages that loaded Overlord RAT
- tldriver
- one of three npm packages that loaded Overlord RAT
- mxdriver
- one of three npm packages that loaded Overlord RAT
- Windows
- the operating system the packages were meant to infect
How the source tells it
The article was mostly neutral technical reporting and did not sustain any distinct emotive framing.
No emotive framing was found in the original.