A report published by Checkmarx on October 5, 2026 details MALFEX, a malicious npm package campaign also investigated by CloudSEK. The documented payloads target Windows and include remote access and credential theft tools. For a team developing an application or maintaining a website, exposure can begin when a dependency is installed or loaded, before the software is shipped.
A dependency can execute code
MALFEX uses several distribution paths. Checkmarx describes installation scripts and code triggered when a package is loaded. The analyses identify Overlord RAT and the movinlike stealer, among other components; they do not show that every installation delivers every payload.
CloudSEK provides complementary research into publisher accounts and dependencies. Review the package chain rather than only the name added directly to the project.
Eight names to check, not forty thousand victims
The malicious packages listed are function-flag, function-color, cdn-img-fetch, img-to-native, native-runner, tlxbnhd, tldriver and mxdriver. Hackread documents companion packages and theft of browser and Discord data.
The 40,767 downloads reported as of October 1 measure registry distribution. The coverage in SecurityWeek does not establish a count of compromised hosts. Package availability described in these reports is dated and does not prove current registry status.
Which access to examine on a workstation
A developer's computer may hold browser sessions, collaboration accounts, and access to repositories or delivery tools. If malicious code runs, assess what was accessible at that time.
Do not limit the review to the npm account password. Our infostealer guide explains why session cookies and tokens also require action within the affected services.
Respond to a suspicious installation
Stop installations and build jobs on the suspect host. Follow your team's isolation procedure and preserve lockfiles and installation records useful to the investigation. Do not run the package again to see what happens.
From a trusted environment, assess passwords, tokens and sessions that need revocation or replacement. Our guide after a password compromise supports that work without replacing examination of the host.
Resume builds with verified dependencies
Review manifests and transitive dependencies, then compare recent changes with expected versions. Limit permission to run installation scripts to identified requirements. Blocking those scripts alone does not cover malicious code executed when a library is loaded.
Before using secrets in another build, confirm that both the environment and dependencies are trustworthy. Record removed packages and the reason for their removal to prevent another project reintroducing them.
The connection with Soclyde
Soclyde organises distinct credentials in an encrypted vault kept on devices. For technical teams, that supports an inventory of access to replace and reduces reuse of the same password.
A local vault does not stop malware acting on a compromised computer or stealing an open session. Token revocation and cleanup must happen in the relevant tools. See Soclyde features for the product's scope.
What to remember
Search projects and installation records for the eight package names without executing them. Removing a dependency does not establish a clean host. If MALFEX may have run, examine both the workstation and professional access, then rebuild from a verified environment.
To prepare a response to stolen sessions and secrets, read our infostealer guide.
