Security1 hOctober 6, 2026, 17:34

NPM malware campaign MALFEX hits 40,000 downloads

Checkmarx detailed MALFEX, an NPM supply chain campaign running since August 2023: 12 packages published, 8 malicious, over 40,000 downloads. The function-flag package has been malicious since July 2025, has 37,000+ downloads and no advisory flags it.

SecurityWeek

Open source

NPM malware campaign MALFEX hits 40,000 downloads

12 packages published, 8 malicious, 5 removed from the registry
function-flag: malicious since July 2025, over 37,000 downloads
Three delivery paths: Overlord RAT, movinlike stealer, separate downloader
Infection affects Windows only, with no geographic targeting

#NPM#Checkmarx

Malicious npm packages evade install-script defenses at runtime

Security

ChainDrop npm Worm Hijacks 444 Packages with 2B Monthly Downloads

Security

Fake ChatGPT ads trick Windows users into downloading malware via ClickFix

Security

NPM malware campaign MALFEX hits 40,000 downloads

Malicious npm packages evade install-script defenses at runtime

ChainDrop npm Worm Hijacks 444 Packages with 2B Monthly Downloads

Fake ChatGPT ads trick Windows users into downloading malware via ClickFix

Ukraine warns of mobile malware campaign with iPhone exploit kit DarkSword