MALFEX NPM MALWARE CAMPAIGN: THREE PAYLOADS AND AN ADVERSARY THAT SIGNS THEIR WORK

Summary from the TLDR InfoSec newsletter

MALFEX, an npm campaign run by a single operator, published eight malicious packages that targeted Windows systems. Its payloads included Overlord RAT and movinlike, a stealer that took Discord tokens, browser credentials, Telegram sessions, and cryptocurrency wallets. Three packages remain installable (function-flag, function-color, and cdn-img-fetch), and the first two have no advisory.