{"id":3423,"date":"2026-10-07T18:01:13","date_gmt":"2026-10-07T18:01:13","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3423"},"modified":"2026-10-07T18:01:13","modified_gmt":"2026-10-07T18:01:13","slug":"eight-malicious-npm-packages-downloaded-40767-times-deliver-overlord-rat-and-stealer","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3423","title":{"rendered":"Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Oct 07, 2026<\/span><\/span><span class=\"p-tags\">Supply Chain \/ Malware<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgopANe3MXyNNOXog__x1pF53wYoQxinI47tN9gLrZSzJfumz-Dg05ZfyjiGsqF47Pugj71iZ1buX7OEiupWYa09xVQdu7DKOMX5NO-uGKCF0UjNila0x5fNiYw5NWEX1TUQTPidjT5NnGmPwM_6mGfKcOxqcjZuPAZLdzRX5u_TXJM76GQ6mQOkikw_kxo\/s1700-nu-rw-lo-l85-e365\/npm-malware.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts.<\/p>\n<p>The campaign has been codenamed <strong>MALFEX<\/strong> by <a href=\"https:\/\/www.cloudsek.com\/blog\/malfex-malicious-npm-postinstall-supply-chain-campaign\" target=\"_blank\">CloudSEK<\/a> and <a href=\"https:\/\/checkmarx.com\/zero-post\/malfex-npm-malware-campaign-three-payloads-and-an-adversary-that-signs-their-work\/\" target=\"_blank\">Checkmarx<\/a>. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have been flagged as malicious.<\/p>\n<ul>\n<li>The attack is designed to infect Windows systems through three separate pathways &#8211;<\/li>\n<li>A loader for <a href=\"https:\/\/github.com\/vxaboveground\/Overlord\" target=\"_blank\">Overlord<\/a>, an open-source RAT written in Go that uses Solana transactions to extract the command-and-control (C2) address<\/li>\n<li>A chain that installs movinlike, a Node.js stealer targeting Discord, browsers, Telegram, and cryptocurrency wallets, and<\/li>\n<li>A downloader<\/li>\n<\/ul>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/growth-ai-control-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVYuoalvwUlwvLZFDideJ8jW4rz-IodX0Lwi7uyP7Ab0wiDeu_BqVhPDdejQQ65MC3p9Xc4MApnHz56NJ5SDc1HMg0DvozkkGYv9TGtDLCh26v1yD5-GyzQxnA5-6A6B4beW96H_6FyrByq22cvU5JDF-i8e5GIfV4wg1SpCvjwAJt74FaqkAb2gzqE7ll\/s728-nu-rw-lo-l85-e365\/core-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The list of identified malicious packages is below &#8211;<\/p>\n<ul>\n<li>tlxbnhd<\/li>\n<li>tldriver<\/li>\n<li>mxdriver<\/li>\n<li>img-to-native<\/li>\n<li>native-runner<\/li>\n<li>function-flag (Still live)<\/li>\n<li>function-color (Still live)<\/li>\n<li>cdn-img-fetch (Still live)<\/li>\n<\/ul>\n<p>In all, these packages have been collectively downloaded 40,767 times. Of these, 37,419 downloads correspond to \u00abfunction-flag,\u00bb making it the largest driver of this activity. The package was first published in July 2024. The latest version was released on August 4, 2025.<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>The project description for the npm package features a welcome message written in Portuguese that states: \u00abThis project was created with a lot of love and dedication by the Malfex team, whose owner is Murizada.\u00bb<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi7Tm9dJYQ14c87MhbFukC1Z1T4qlxyjfhM7jSHOsWAHjG_lVqYs3lYd2-YtmaOjSKp4YhzscLXA4SMRbCOLkNN8zq86_FWwJpVDnhEl2DntqNxGfVH4pFhHqZBRoqsIULKLMSXL4Sf2Ijgde0wUAo_WZD6tOVs45-GPLeWi8AUz05dNELqIuuHYhsSnm8S\/s1700-nu-rw-lo-l85-e365\/aes.jpg\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi7Tm9dJYQ14c87MhbFukC1Z1T4qlxyjfhM7jSHOsWAHjG_lVqYs3lYd2-YtmaOjSKp4YhzscLXA4SMRbCOLkNN8zq86_FWwJpVDnhEl2DntqNxGfVH4pFhHqZBRoqsIULKLMSXL4Sf2Ijgde0wUAo_WZD6tOVs45-GPLeWi8AUz05dNELqIuuHYhsSnm8S\/s1700-nu-rw-lo-l85-e365\/aes.jpg\" alt=\"\" border=\"0\" data-original-height=\"683\" data-original-width=\"1310\"\/><\/a><\/div>\n<p>Three of the packages, \u00abtlxbnhd,\u00bb \u00abtldriver,\u00bb and \u00abmxdriver,\u00bb act as Overlord RAT loaders, with the malicious code triggered via lifecycle hooks to download and run a Windows executable.<\/p>\n<p>A second subset of the npm packages, such as \u00abimg-to-native,\u00bb requires \u00abcdn-img-fetch\u00bb to retrieve and execute a Go executable, which then fetches a Node.js stealer capable of harvesting sensitive data.<\/p>\n<p>Present within \u00abfunction-flag\u00bb is a postinstall hook that runs a JavaScript payload to download a payload from a remote server. Each version of the package has been found to serve a payload from a different location. The \u00abfunction-color\u00bb package embeds no payload of its own, but lists \u00abfunction-flag\u00bb as a dependency.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVV2rRkX8tRMF6gCzemvQNpwFwGxRWxY1cJEYfoLLSj1EZYJOlj5WTR77t0i6kELXujYcaHTpRDqTjCbVHH5Pnh7wzxUiKP5j4dsDkWIMlp2bmpZsL0jeAsA_19pHH5UPtyBvNkZdyGEULOAsXPcraMP5CYjQRFefhXRSdEjYkrdcpUnc4ILcvcdEfAauE\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>\u00abIn 1.7.3, the current latest version, the postinstall script runs example.js, which calls the package&#8217;s ASCII art function with the Bloody font,\u00bb Checkmarx said. \u00abThat font value triggers a hidden routine that downloads node.exe from cdnzona.discloud.app, a host on a Brazilian application hosting service, saves it to %APPDATA%\\node.exe, and runs it with its window hidden.\u00bb<\/p>\n<p>Interestingly, Overload RAT has been observed in two other campaigns since July 2026: one involving the exploitation of WordPress flaws (CVE-2026-63030 and CVE-2026-60137, aka wp2shell) and a <a href=\"https:\/\/www.jamf.com\/blog\/fake-zoom-installer-delivers-overlord-rat-macos\/\" target=\"_blank\">macOS campaign<\/a> in which a fake Zoom installer is used to deploy the RAT. The fake Zoom installer campaign shares tactical overlaps with a suspected North Korea-aligned threat cluster dubbed UNK_DeadDrop.<\/p>\n<p>\u00abThe operator is Portuguese-speaking, the git commits sit at -0300, one repository description is in Portuguese, and the GitHub display name and email give a common Brazilian handle,\u00bb CloudSEK said. \u00abNone of this is an argument that the campaign targets Brazil. It is a piece of attribution to the operator&#8217;s own linguistic space and nothing more. The delivery is npm and Discord, both of which are global; the second-stage targeting is opportunistic.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Oct 07, 2026Supply Chain \/ Malware Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3424,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[529,1860,33,39,3690,35,264,478,3689],"class_list":["post-3423","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-deliver","tag-downloaded","tag-malicious","tag-npm","tag-overlord","tag-packages","tag-rat","tag-stealer","tag-times"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3423","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3423"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3423\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3424"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3423"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3423"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3423"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}