Loading story…
The MALFEX npm supply-chain campaign, attributed to an apparent single operator active since August 2023, published eight malicious packages among 12 packages examined, according to Checkmarx. The malicious packages accumulated 40,767 downloads by October 1, 2026, although download counts do not establish confirmed infections. Three independent delivery chains compromise Windows systems using Overlord remote-access Trojan loaders, the Node.js information stealer movinlike, or version-specific downloaders in function-flag that retrieve additional Windows executables. Checkmarx found no geographic or organizational targeting and said exposure was limited to systems directly installing the operator’s packages, rather than propagation through legitimate, widely used dependencies.
Three packages—function-flag, function-color and cdn-img-fetch—remained installable in late September and early October, with missing or incomplete security advisories. function-flag alone accounted for more than 37,000 downloads and lacked an advisory identifying it as malicious despite containing malicious code since July 2025. Defenders should block all eight identified malicious packages, inspect dependencies and lockfiles for exposure, and isolate potentially compromised Windows systems. Remediation should include removing persistence and rotating potentially exposed credentials from a clean device.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
A Discord webhook used by the Movinlike information stealer was created in a newly created server. Researchers subsequently confirmed the webhook was live; the malware sends stolen data to it in compressed chunks of up to 25 MB.
The function-flag npm package became malicious, using version-specific downloaders to retrieve Windows payloads from changing external locations. It became the campaign's most widely downloaded package, accumulating more than 37,000 downloads.
The MALFEX campaign began with its operator's first npm package publication. Researchers subsequently linked the campaign's packages to an apparent single operator.
CloudSEK linked the campaign to the Malfex team, whose function-flag README names Murizada as its owner, and associated it with the cavecrew GitHub account. Supporting identifiers included the shared malfexteam2027 payload key, related npm publisher handles and the Git author email corpmalfex@gmail.com.
Checkmarx identified three independent delivery chains linked to the same operator, distributing Overlord RAT, the movinlike information stealer and additional Windows executables through malicious npm packages. The operator's packages recorded 40,767 downloads by October 1, 2026, although downloads do not establish confirmed infections; researchers found no legitimate or widely used packages depending on the operator's packages.
Open Source Vulnerabilities advisories were published for tlxbnhd, tldriver, mxdriver, img-to-native, native-runner and cdn-img-fetch. The cdn-img-fetch advisory omitted two malicious versions, while function-flag and function-color lacked advisories.
Five of the campaign's eight malicious packages were removed from the npm registry. The remaining malicious packages—function-flag, function-color and cdn-img-fetch—were still installable as of October 1, 2026.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 45 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
9 references tracked. Mallory keeps watching after this page renders.
orca.security
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcethehackernews.com
Open sourcecysecurity.news
Open sourcesecurityweek.com
Open sourcecheckmarx.com
Open sourcecloudsek.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sonatype Research Labs reported an active software supply-chain campaign, dubbed **Flooding Dropper**, that pushed roughly **850 malicious npm packages** through disposable publisher accounts and patterned package names and versions. The packages act as first-stage JavaScript loaders that fetch and execute platform-specific second-stage payloads for **Windows, Linux, and macOS**, using both HTTPS downloads and **DNS TXT record** fallback to maintain delivery if primary infrastructure is blocked. The activity aligns with **CWE-506: Embedded Malicious Code**, a weakness category covering intentionally harmful functionality such as trojans, trapdoors, and spyware embedded in distributed software. Sonatype said the Windows payload uses defense evasion and persistence techniques including patching **ETW** and **AMSI**, checking for analysis environments, creating **Registry Run keys** and scheduled tasks, and reflectively loading an encrypted payload in memory; defenders are advised to treat any system that installed an affected package as compromised, investigate persistence and follow-on payload execution, and rotate exposed credentials only after remediation is complete.
Aug 9, 2026
Researchers linked a threat actor tracked as **RED-LILI** to a large-scale software supply chain attack that pushed nearly **800 malicious packages** to the **npm** registry in a burst of activity over roughly a week. Checkmarx reported the operation began around February 23, 2022, and relied on a highly automated pipeline that created a separate npm account for each package, complicating bulk detection and takedown efforts. The campaign used custom Python tooling, Selenium, and the open-source **Interactsh** project to automate account creation and bypass npm email one-time-password verification during signup. The malicious packages were part of a broader effort to compromise developers and downstream environments through common package ecosystem abuse techniques, including **typosquatting** and **dependency confusion**. Reporting tied the activity to packages crafted to target organizations such as **Azure, Uber, and Airbnb**, underscoring how attackers can industrialize package publication at scale and turn open-source repositories into an efficient delivery channel for supply chain compromise.
Aug 15, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026