Checkmarx finds malicious npm package function-flag still installable after 37,000 downloads
Checkmarx says function-flag, malicious since July 2025 and downloaded more than 37,000 times, is still on npm with no advisory flagging it. Advisory-based scanners have nothing to match, so finding it means checking lockfiles for the campaign's eight names.
The Watch · Security desk
What happened
- The operator behind MALFEX has published 12 npm packages since August 2023, eight of them malicious, with more than 40,000 downloads between them.
- Open Source Vulnerabilities (OSV) has published advisories for six of the eight malicious packages.
- Checkmarx traced three delivery paths with no shared infrastructure between them, all tied to the same actor.
Why it matters
- What it limits constraint Teams relying on advisory feeds get no alert for function-flag, and OSV-based tools miss function-color too, so detection depends on matching package names directly.
- What it limits constraint A blocklist entry for one function-flag payload host protects against a single release, since each version pulls from its own location.
- Who's exposed exposure Windows hosts with a direct install are the exposed population, and the documented payloads hand the operator keystrokes, a remote shell and browser and wallet data.
- Who has to decide decision With no legitimate package depending on these names, a dependency tree that lacks a direct install of all eight needs no further work for this campaign.
Next story · Security · Oct 6
Malicious indexed-btree package moves npm malware from install scripts to first useConfirmed2 publishers
The five packages already removed from the registry all have OSV entries [18]. The gaps are on the three still live. Function-flag and function-color are not on the OSV list, and the cdn-img-fetch entry covers two of that package's four malicious versions [17][12]. Function-flag accounts for about nine-tenths of the campaign's reported downloads [16].
According to Checkmarx, function-flag is the campaign's longest-running delivery path [14]. Each malicious version ships its own downloader, and each downloader fetches its payload from a different location [14]. Blocking one payload host covers one release [20]. The install finishes even when the download fails [15]. On macOS and Linux the routine fails silently, so only Windows machines get a working payload [15].
The other two paths run at different stages. The first runs obfuscated scripts during npm install on Windows, macOS and Linux, though its Overlord RAT payload works only on Windows [7]. Overlord gives the operator screen capture, keylogging, window monitoring, a remote shell, file search and a hidden desktop [8]. The second path runs when the package is loaded and drops movinlike, a Node.js stealer aimed at eight Discord clients, seven browsers and cryptocurrency wallets [9]. Turning off install scripts addresses the first path and leaves the second untouched [19].
One operator has run MALFEX, Checkmarx's name for the campaign, since August 2023 [2][3]. Its three paths share no infrastructure [13]. Checkmarx describes the reach as narrow and untargeted. "No legitimate or widely used packages depend on any operator package, so exposure is limited to systems that installed these package names directly. We found no geographic or organizational targeting; anyone who installs the stealer becomes a target," Checkmarx wrote [10].
The eight malicious names are tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, cdn-img-fetch, function-flag and function-color [11][5]. A scanner that matches dependencies against advisories has no entry for function-flag. A name search across lockfiles and install logs will find it [21]. The Windows-only limit is reported for the Overlord payload and for function-flag, not for movinlike [7][15][9].
What to watch
- Whether the registry pulls function-flag, function-color and cdn-img-fetch, and whether OSV adds function-flag and function-color and extends the cdn-img-fetch entry to all four malicious versions.
- A new function-flag release; each version so far has carried its own downloader and payload location, so a fresh publish would show the operator still working that path.
- Any report of a legitimate package taking a dependency on one of the operator's packages, since that would extend exposure past direct installs.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption20
- Hype gap+15
- Incentives55
- Confidence68
Perspective Coverage
3 publishers- Builder
- Builder 43%
- Operator
- Operator 50%
- Investor
- Investor 7%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Malicious packages published as part of the campaign have accumulated over 40,000 downloads, according to Checkmarx.
- [2]
The campaign, dubbed MALFEX, distributes malware such as the Overlord RAT and infostealers.
- [3]
The campaign has been ongoing since August 2023, when the threat actor published its first package.
- [4]
The threat actor has published 12 packages, eight of which are malicious.
- [5]
Five of the malicious packages have been removed from the registry; three were still installable as of October 1: function-flag, function-color and cdn-img-fetch.
- [6]
Function-flag has been malicious since July 2025, has more than 37,000 downloads, and no advisory flags it as malicious.
- [7]
The first path involves Overlord RAT loaders and obfuscated scripts executed during npm install; the scripts can launch on Windows, macOS and Linux, but the payload only works on Windows.
- [8]
The Overlord RAT provides screen capture, keylogging, window monitoring, remote shell access, file search and a hidden desktop.
- [9]
In the second path, malicious code executes when the package is loaded and drops the Node.js information stealer movinlike, which targets eight Discord clients, seven popular browsers and cryptocurrency wallets.
- [10]
"No legitimate or widely used packages depend on any operator package, so exposure is limited to systems that installed these package names directly. We found no geographic or organizational targeting; anyone who installs the stealer becomes a target."
- [11]
OSV advisories have been published for six malicious packages: tlxbnhd, tldriver, mxdriver, img-to-native, native-runner and cdn-img-fetch.
- [12]
The OSV entry for cdn-img-fetch covers only two of its four malicious iterations.
- [13]
Checkmarx identified three independent delivery paths that do not share infrastructure but are linked to the same threat actor.
- [14]
The third path is the longest-running part of the campaign: each malicious version of function-flag contains a separate downloader designed to fetch a payload from a different location.
- [15]
The infection routine lets package installation complete even if the payload download fails; it fails silently on macOS and Linux, so only Windows systems are affected.
- [16]
Function-flag accounts for about nine-tenths of the campaign's reported downloads.
- [17]
Two of the three still-installable packages, function-flag and function-color, have no OSV advisory.
- [18]
The five malicious packages removed from the registry are tlxbnhd, tldriver, mxdriver, img-to-native and native-runner, and all five have OSV advisories.
- [19]
Disabling npm install scripts addresses the install-time first path but not the second path, which executes when the package is loaded.
- [20]
Blocking a single function-flag payload location covers only the version that uses it, because each version fetches from a different location.
- [21]
A scanner that matches dependencies against advisories has no entry to flag function-flag, so a direct name search is the way to find it.
Sources
3 independent publishers whose own reporting we read for this story.
- orca.securityMalicious npm Campaign “MALFEX” Delivers RAT and Stealer via Eight Packages with 40,000+ Downloads
1 article · October 8, 2026
- securityweek.comLong-Running NPM Malware Campaign Accumulates 40,000 Downloads - SecurityWeek
2 articles · October 6, 2026
- thehackernews.comEight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
1 article · October 7, 2026
Topics and entities
Entities
- Amazon Inspector
- Checkmarx
- CloudSEK
- Orca Security
- OSV
- npm registry