A threat actor has been publishing malicious packages to the npm registry since August 2023, and three of them could still be installed as of Oct. 1, SecurityWeek reported Tuesday. Checkmarx researchers, who named the campaign MALFEX, said the actor's malicious packages have been downloaded more than 40,000 times.

What Happened

According to Checkmarx, the actor published 12 packages, eight of which were malicious. Five of those have been removed from npm. The three still available as of Oct. 1 were function-flag, function-color and cdn-img-fetch.

The function-flag package accounts for most of the activity. It has been malicious since July 2025 and has been downloaded about 37,000 times, yet Checkmarx said no advisory flags it as malicious. That gap means developers relying on advisory-based tooling would have had no warning.

RelatedNew curl Release Fixes 24 Flaws, Including a High-Severity Bug Reported With Anthropic’s Claude

The packages deliver two main payloads. Overlord is a remote access trojan that gives operators screen capture, keylogging, window monitoring, a remote shell, file search and a hidden desktop for carrying out actions out of the user's view. Movinlike is a Node.js information stealer aimed at eight Discord clients, seven popular browsers and cryptocurrency wallets.

Checkmarx found no sign that the campaign targets specific countries or organizations. The install scripts can run on Windows, macOS and Linux, but the infection routine fails silently on macOS and Linux, so the payloads mainly affect Windows machines.

Why It Matters

The npm registry is the default source of JavaScript packages for millions of projects, and a single install command can pull in code that runs with the developer's privileges. A package that stays live and unflagged for more than a year shows how long malicious code can circulate when it does not trip automated checks.

Advisory coverage is uneven. Open Source Vulnerabilities (OSV) advisories exist for six of the malicious packages, but the one for cdn-img-fetch covers only two of its four malicious versions. Software composition analysis tools that rely on OSV data could therefore report some affected versions as clean.

The payload mix also points to the value of developer machines. Discord tokens, browser-stored credentials and wallet data can be monetized directly, while a remote access trojan on a developer workstation can open a path to source code, cloud credentials and build systems.

How Developers Can Respond

Teams can search their lockfiles and dependency trees for function-flag, function-color and cdn-img-fetch, including as transitive dependencies. Any Windows machine that installed one of them should be treated as compromised, which means rotating credentials and session tokens stored on it, including Discord tokens, browser-saved passwords and any cryptocurrency wallet keys. Because public advisories are incomplete, checks should cover every version of the named packages rather than only those listed in OSV.

What to Watch

The next steps are whether npm removes the three remaining packages and whether OSV and other advisory databases are updated to cover function-flag and all malicious versions of cdn-img-fetch. Checkmarx's findings may also prompt other researchers to look for related packages published under different names by the same actor.