Checkmarx (5 October 2026) and CloudSEK (30 September 2026) describe MALFEX, an npm supply-chain malware campaign run by what appears to be one operator publishing since August 2023. Checkmarx counts twelve packages, eight of them malicious; CloudSEK's count is at least nine. The campaign has three delivery paths that do not share infrastructure: install scripts in tlxbnhd, tldriver and mxdriver that load the open-source Go remote access trojan Overlord (screen capture, keylogging, remote shell, hidden desktop; CloudSEK says this build has a working Solana-blockchain lookup for its command server); img-to-native, native-runner and cdn-img-fetch, which drop the Node.js stealer movinlike, aimed at Discord clients, browsers, crypto wallets and Telegram data and sending it out through a Discord webhook; and function-flag, where each malicious version downloads a payload from a different location.

The scripts run on any OS but the payloads only work on Windows, and installs complete even when the download fails. Checkmarx says function-flag has been malicious since July 2025, has more than 37,000 downloads and still had no advisory, and that function-flag, function-color (which pulls it in) and cdn-img-fetch were still installable on 1 October; the cdn-img-fetch advisory MAL-2026-17320 covers only some malicious versions.

Five packages have been removed. No legitimate, widely used package depends on them and neither firm saw geographic targeting. Primary: Checkmarx; also CloudSEK; wire: SecurityWeek (6 Oct).

UPDATE 13–17 Oct 2026: SafeDep (13 October) found that the operator kept replacing removed packages. After npm removed native-runner and img-to-native on 28 September, imgbundle and runhelper appeared on 30 September, and the same day the publisher 'malfexteste8' released imgdecode, which hides the loader in a compiled Node.js add-on (a 64-bit Windows DLL). Versions 1.0.0 to 1.0.3 are affected; 1.0.3 (11 October) needs no other MALFEX package.

There is no install script: the code runs when a program calls require('imgdecode'), and only when output goes to an interactive Windows console, so CI jobs and sandboxes with redirected output do not trigger it. The DLL downloads banner.jpg from the GitHub repository cavecrew/proj, decrypts it with AES-256-CBC and injects the result into a new dllhost.exe process. SafeDep linked it to MALFEX with high confidence because the recovered stage-2 downloader hash is in Checkmarx's indicator list; that downloader fetches the stealer and remote access tool from 104.234.65[.]75 port 700, with command and control on port 7007.

Per The Hacker News (17 October), imgdecode had 979 downloads and was still on npm; the payload persists through a Registry Run key and a scheduled task named 'MicrosoftEdgeUpdateService'. npm removed imgbundle on 7 October and cdn-img-fetch on 8 October; runhelper was unpublished on 30 September. The GitHub account cavecrew is no longer accessible.