MALFEX npm Packages Deliver Overlord RAT and movinlike

Eight malicious MALFEX npm packages, downloaded 40,767 times since August 2023, install Windows Overlord RAT or the movinlike stealer.

Checkmarx, with CloudSEK also cited by The Hacker News, disclosed MALFEX, an npm supply-chain campaign a lone operator has run since August 2023 by publishing 12 packages, eight of them malicious and aimed at Windows developers. The Hacker News, GBHackers, and Cyber Security News put collective downloads at 40,767 by October 1, 2026, while SecurityWeek said more than 40,000; function-flag alone is 37,419 in the more specific counts (SecurityWeek said it exceeds 37,000), and GBHackers said that package has contained malicious code since July 2025. Install hooks and version-specific downloaders deliver Overlord RAT—which can capture screens, log keys, open a remote shell, and search files, is described by The Hacker News as Go-based and as reading its command-and-control address from Solana transactions, and persists with a scheduled task named Maiden that Cyber Security News says runs every five minutes—or the Node.js stealer movinlike. Cyber Security News added that one path fetches a file labeled as a PNG that is actually a Microsoft IExpress archive and launches Overlord through a signed AutoIt interpreter, while another appends AES-encrypted data to a real PNG and uses a Go downloader to retrieve movinlike, which targets Discord, browser cookies and passwords, Telegram Desktop sessions, and wallets including MetaMask, Phantom, and Coinbase Wallet before exfiltrating via a Discord webhook. SecurityWeek said exposure is limited to direct installs and that no popular packages depend on the malware; function-flag, function-color, and cdn-img-fetch were still installable around October 1, and OSV coverage differs—SecurityWeek said advisories cover six packages but incompletely for cdn-img-fetch, while GBHackers said function-flag and function-color had none. The Hacker News also reported Overlord in WordPress exploitation of CVE-2026-63030 and CVE-2026-60137 and in a fake Zoom macOS installer overlapping the UNK_DeadDrop cluster.

• Checkmarx, with CloudSEK also cited by The Hacker News, disclosed MALFEX, an npm campaign a lone operator has run since August 2023 by publishing 12 packages, eight of them malicious and aimed at Windows.
• The Hacker News, GBHackers, and Cyber Security News put downloads at 40,767 by October 1, 2026; SecurityWeek said more than 40,000. function-flag alone is 37,419 (SecurityWeek: exceeds 37,000) and GBHackers said it has been malicious since…
• Install hooks and version-specific downloaders deliver Overlord RAT—screen capture, keylogging, remote shell, and file search—or the Node.js stealer movinlike. The Hacker News said Overlord is Go-based and reads its C2 address from Solana…