MALFEX npm Campaign Delivers Overlord RAT and Stealers Through Eight Malicious Packages
Summary
Researchers say the MALFEX campaign used eight malicious npm packages, downloaded 40,767 times, to deliver Overlord RAT loaders and information stealers through install hooks and package dependencies.
Key points
- Researchers attribute the campaign, active since at least August 2023, to a suspected lone threat actor who published 12 npm packages; eight were identified as malicious.
- The packages received 40,767 downloads in total, including 37,419 for function-flag.
- Packages tlxbnhd, tldriver, and mxdriver use lifecycle hooks to download and run a Windows executable that loads Overlord RAT.
- The img-to-native package and related dependencies retrieve a Go executable that then fetches a Node.js information stealer.
- In function-flag version 1.7.3, a postinstall script triggers a hidden routine that downloads node.exe and runs it from the user's AppData directory.
- Researchers cited Portuguese-language and Brazilian-related clues as attribution context, while noting these do not show that Brazil is the campaign's target.
Article Details
- Attack Vectors
- Malicious npm packages use lifecycle hooks to download and execute payloads.
- The packages tlxbnhd, tldriver, and mxdriver act as loaders for Overlord RAT.
- Packages including img-to-native use cdn-img-fetch to retrieve and execute a Go executable, which fetches a Node.js stealer.
- The function-flag postinstall hook runs a JavaScript payload that downloads a remote payload; function-color lists function-flag as a dependency.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cdnzona[.]discloud[.]app | Host used to download node.exe as a payload. |
MITRE ATT&CK
T1059.007 · JavaScriptA JavaScript postinstall payload downloads another payload.T1105 · Ingress Tool TransferPackage scripts download executables and other payloads from remote hosts.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious npm packages distribute payloads through the software supply chain.
CVE
CVE-2026-60137campaigns since July 2026: one involving the exploitation of WordPress flaws (CVE-2026-63030 and CVE-2026-60137, aka wp2shell) and a macOS campaign in which a fake Zoom installer is used to deploy the RAT. TheCVE-2026-63030observed in two other campaigns since July 2026: one involving the exploitation of WordPress flaws (CVE-2026-63030 and CVE-2026-60137, aka wp2shell) and a macOS campaign in which a fake Zoom installer is used to
Malware
Overload RATInterestingly, Overload RAT has been observed in two other campaigns since July 2026: one involving the exploitation of WordPress flaws (CVE-2026-63030 and CVE-2026-60137, aka wp2shell) and a macOS campaign in which aOverlord RATThree of the packages, "tlxbnhd," "tldriver," and "mxdriver," act as Overlord RAT loaders, with the malicious code triggered via lifecycle hooks to download and run a Windows executable.
Products
npmCybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts.WordPressRAT has been observed in two other campaigns since July 2026: one involving the exploitation of WordPress flaws (CVE-2026-63030 and CVE-2026-60137, aka wp2shell) and a macOS campaign in which a fake ZoomZoomof WordPress flaws (CVE-2026-63030 and CVE-2026-60137, aka wp2shell) and a macOS campaign in which a fake Zoom installer is used to deploy the RAT. The fake Zoom installer campaign shares tactical overlaps with a