High
threats
MALFEX npm malware campaign delivers Overlord RAT and stealer
Checkmarx and CloudSEK tie eight malicious npm packages to one operator branded MALFEX. npm counts 40,767 lifetime downloads as of 1 October 2026, 37,419 of them for function-flag. Preinstall and postinstall scripts, plus code that runs on require, deliver Overlord RAT, the movinlike Node.js stealer, or a downloader to Windows hosts. function-flag, function-color and cdn-img-fetch were still installable on 7 October 2026.
