Eight Malicious npm Packages, Downloaded 40,767 Times, Hid Malware's Control Channel in Solana

Security researchers at Checkmarx reported on October 5, 2026 that a supply-chain campaign researchers call MALFEX has used eight malicious JavaScript packages on the npm registry — downloaded a combined 40,767 times since the operation began in August 2023 — to plant Windows malware whose control-server address is hidden inside Solana blockchain transactions instead of a fixed domain or IP address. The threat-intelligence firm CloudSEK had already documented the same packages and operator in a report published September 30, 2026, and The Hacker News covered both findings on October 7, 2026.

According to Checkmarx, the eight packages — tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, function-flag, function-color, and cdn-img-fetch — sit inside a larger set of twelve packages that Checkmarx traced to the same operator. One package alone, function-flag, accounts for 37,419 of the 40,767 total downloads Checkmarx recorded. Developers typically pulled these packages in as small utilities; most delivered the next stage through preinstall or postinstall scripts, though one chain ran its payload-fetching code as soon as the package loaded, without using an install hook at all.

Checkmarx's analysis describes three separate malware families delivered through different package chains. The first, a Go-written remote access trojan called Overlord, arrives through tlxbnhd, tldriver, and mxdriver, which fetch a Windows executable disguised as a PNG image from an image-hosting API. The second, a Node.js credential stealer Checkmarx calls "movinlike," is delivered through a three-package chain — cdn-img-fetch, img-to-native, and native-runner — that pulls an image file from GitHub with encrypted data appended to it and decrypts a downloader from the result. The third, built around function-flag's postinstall script, runs a hidden routine that downloads an executable from rotating URLs.

A Control Channel With No Fixed Address

The detail that sets this campaign apart, per Checkmarx's writeup, is how Overlord finds its command server. Rather than contacting a hardcoded domain, the malware reads encrypted memo fields attached to transactions on the Solana blockchain, decrypts them, and uses the result as a list of command-and-control addresses. Because the operator can post a new memo from any wallet to update that list, there is no single server or domain for defenders to seize or sinkhole — takedown has to target the npm packages and the malware itself rather than a piece of infrastructure. CloudSEK, which documented the campaign five days before Checkmarx's report, says this is the first sample it has seen where that Solana-memo mechanism is actually switched on, rather than present in the code but disabled.

Once installed, Checkmarx found Overlord capable of keylogging, screen and clipboard capture, file search, a remote shell, and a hidden virtual desktop that lets an attacker operate the compromised machine without the user noticing anything on screen. The Hacker News' October 7 report adds that Overlord has turned up in two unrelated campaigns around the same period — exploitation of WordPress sites tracked as CVE-2026-63030 and CVE-2026-60137, and a macOS installer disguised as Zoom that the report says shares tactical overlaps with a North Korea-aligned cluster it calls UNK_DeadDrop — meaning the same malware is apparently being reused or shared across operators who target different platforms entirely.

An Operator That Signs Its Own Work

Checkmarx says the person or group behind MALFEX left unusually clear fingerprints: five related npm publisher accounts carrying variations of the "malfex" name, a git commit author email of corpmalfex@gmail.com, and a hardcoded decryption-key string reading "malfexteam2027" inside the malware itself. Checkmarx reports that the README for one package, cdn-img-fetch, names its owner as "Murizada" and adds that "this project was created with a lot of love and dedication by the Malfex team." CloudSEK's report adds that git-commit timestamps carrying a -0300 offset and Portuguese-language artifacts point to a Brazilian operator, and traces a GitHub account under the handle "cavecrew" with the display name "muriel" — though CloudSEK does not treat this as a confirmed real-world identity.

Still Live on npm

As of September 29, 2026, Checkmarx found that three of the eight packages — function-flag, function-color, and cdn-img-fetch — remained installable directly from the npm registry, while five others had already been pulled, unpublished or seized. Checkmarx's report does not describe npm's advisory process catching up with the full set, which means a developer running npm install on an unfamiliar small utility package could still retrieve malicious code during the period the researchers were publishing their findings.

Why It Matters Beyond This Campaign

For engineers studying software supply-chain security, MALFEX is a concrete case of two trends researchers have been tracking separately: malware that survives takedown by resolving its command infrastructure through a public blockchain instead of DNS, and small, innocuous-looking npm utility packages used as the initial foothold rather than well-known libraries. CloudSEK's report title makes the scale of the detection gap explicit: function-flag's malicious postinstall script went fourteen months without an advisory despite tens of thousands of downloads under a name that gave no hint of what the package did. Checkmarx's own count shows three of the eight packages were still live on npm as of September 29, 2026 — a reminder that a package's download total or plausible-sounding name says nothing about what its install scripts actually do.