MALFEX npm campaign: function-flag and two siblings still installable, 40,767 downloads
Two credible outlets have now named the three packages that remained live and unflagged, so dependency scanners will not have caught them and any project that pulled them has stealer-harvested developer credentials in attacker hands.
Checkmarx and CloudSEK documented a three-year npm campaign (MALFEX) in which a single actor published 12 packages, eight of them malicious, delivering the Overlord Go RAT and the movinlike Node.js stealer that targets browsers, Discord, Telegram and crypto wallets on Windows. OSV advisories exist for six packages, but function-flag — malicious since July 2025 and with more than 37,000 downloads — carried no advisory, and function-flag, function-color and cdn-img-fetch were still installable from the registry as of October 1.
Affected: npm function-flag (all versions); npm function-color; npm cdn-img-fetch; npm tlxbnhd; npm tldriver; npm mxdriver; npm img-to-native; npm native-runner
How to Test
Run `npm ls function-flag function-color cdn-img-fetch tlxbnhd tldriver mxdriver img-to-native native-runner` across repos and grep all lockfiles for those names; check the npm cache and CI install logs going back to July 2025 for function-flag in particular, and on Windows build agents look for Go-based Overlord loader processes beaconing to C2 addresses resolved from Solana transactions and for stealer access to browser, Discord and Telegram credential stores.
How to Mitigate
Remove the packages and replace them with maintained alternatives, block them in your registry proxy or allowlist, reimage affected Windows developer and build hosts, and rotate browser-stored credentials, developer tokens and any wallet keys that were present on those machines.