The Hacker News reported on 7 October that CloudSEK and Checkmarx have named a long-running npm campaign MALFEX. npm is the main store for JavaScript code. The researchers believe one person published 12 packages since August 2023, and eight were flagged as malicious. The Hacker News said the eight were downloaded 40,767 times, 37,419 of them for function-flag. They target Windows, installing Overlord, a remote-control tool, or a stealer aimed at Discord, browsers and Telegram.
CloudSEK said Amazon Inspector issued advisories for five of the eight between 22 and 28 September 2026. No advisory covers function-flag, cdn-img-fetch or function-color. The Hacker News said function-flag was first published in July 2024, with a last version on 4 August 2025. CloudSEK said it has been malicious since 18 July 2025. It uses a postinstall hook, a step that runs by itself at install. Function-color has no payload but lists function-flag as a dependency. Img-to-native needs cdn-img-fetch, which CloudSEK said is still installable after npm seized img-to-native. How many machines were infected is not stated.
A takedown does not remove what a package pulls in. CloudSEK advises blocking the three live packages and checking all declared dependencies at takedown. Leaders can ask: can we list what our build machines install? If a registry removes one package but not its dependencies, would we notice?