function-flag took 37,419 of MALFEX's 40,767 downloads

Of the 40,767 downloads across eight malicious npm packages in the campaign CloudSEK and Checkmarx call MALFEX, 37,419 went to a single package: function-flag. It was first published in July 2024, its most recent version shipped on August 4, 2025, and it is still live on the registry.

The campaign is attributed to a lone actor who has published 12 packages since August 2023, eight of them flagged as malicious: tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, function-flag, function-color, and cdn-img-fetch. The last three are still available. One project description carries a welcome message in Portuguese crediting “the Malfex team, whose owner is Murizada.”

All of it targets Windows, through three separate delivery paths.

The simplest is a set of Overlord RAT loaders. tlxbnhd, tldriver, and mxdriver use npm lifecycle hooks to download and run a Windows executable at install time. Overlord is an open-source RAT written in Go, and it finds its command-and-control server in an unusual way: it reads a Solana transaction to extract the C2 address. Putting the address on a public blockchain leaves no fixed domain to block or sinkhole, and the operator can rotate it by publishing a new transaction.

The second path adds a stage. native-runner, img-to-native, and cdn-img-fetch fetch and run a Go executable, which in turn pulls down a Node.js stealer the researchers track as movinlike. It harvests from Discord, browsers, Telegram, and cryptocurrency wallets.

The third path is the one worth reading the code for. function-flag carries a postinstall hook, and each version served its payload from a different host. In 1.7.3, the current version, the postinstall script runs example.js, which calls the package’s ASCII-art function with the “Bloody” font. That font value is the trigger. Passing it runs a hidden routine that downloads node.exe from cdnzona.discloud.app, a Brazilian application-hosting service, writes it to %APPDATA%\node.exe, and runs it with the window hidden. A second package, function-color, ships no payload at all. It simply lists function-flag as a dependency, so installing it pulls the live one in behind a harmless-looking name.

That last mechanism is the part to sit with. The postinstall script looks like a demo that prints a banner, and the malicious behaviour hides behind one specific argument value. Static review that stops at “it renders ASCII art” misses it entirely.

Overlord itself has shown up elsewhere. Since July 2026, CloudSEK notes two other campaigns delivering it: one exploiting WordPress flaws (CVE-2026-63030 and CVE-2026-60137, tracked as wp2shell) and a macOS campaign using a fake Zoom installer. The fake Zoom activity overlaps tactically with a suspected North Korea-aligned cluster, UNK_DeadDrop. The npm operator looks like a separate, Portuguese-speaking author: git commits at -0300, a Portuguese repository description, a common Brazilian GitHub handle and email. CloudSEK is explicit that this places the operator in a linguistic space and says nothing about who gets hit. The delivery is npm and Discord, both global, and the second-stage targeting is opportunistic.

The three live packages should be pulled or blocked at your registry proxy now. Beyond that, one defence stops all three paths, because every one of them fires at install time through npm’s lifecycle scripts. Running installs with --ignore-scripts (or the equivalent in your CI and lockfile tooling) breaks the loaders, the downloader, and the postinstall trigger in function-flag. Pin exact versions so a compromised later release cannot reach a build that was clean yesterday. And walk transitive dependencies, because function-color exists for no reason other than to drag function-flag in.