Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCheckmarx recorded 40,767 npm downloads across eight malicious packages linked to the MALFEX campaign as of October 1, 2026. That is a registry-download count, not a count of infected computers, unique users, or confirmed victims. The campaign used three reported delivery paths, and Checkmarx’s observations of which packages were still installable apply only to late September and October 1—not to their status today.
What MALFEX is—and what the download count means
Checkmarx describes MALFEX as an npm supply-chain malware campaign linked to what appears to be one operator publishing packages since August 2023. Its October 5, 2026 report attributes 12 packages to the operation: eight malicious packages and four benign cover packages.
As an Amazon Associate I earn from qualifying purchases.
The headline figure is based on npm public download statistics recorded on October 1, 2026. Package downloads measure registry activity; they do not establish how many distinct systems downloaded a package, whether malicious code ran, or whether an infection succeeded. The sources do not provide a victim count.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| npm download statistic | What it covers | Qualification |
|---|---|---|
| 40,767 | All eight malicious packages | npm public download statistics as of October 1, 2026; downloads, not confirmed compromises. |
| 37,419 | function-flag |
npm public download statistics as of October 1, 2026; this package’s count is included in the overall total. |
| 3,017 | All eight malicious packages in the prior week | npm public download statistics as of October 1, 2026; a weekly download count, not a victim count. |
Checkmarx dates the start of operator activity to August 6, 2023, and says function-flag had been malicious since July 2025. SecurityWeek’s October 6, 2026 report independently summarized Checkmarx’s findings. Neither source establishes how many organizations or people were affected.
#1 Best Overall
Which packages Checkmarx identified
The eight packages Checkmarx classified as malicious were:
function-flag— downloaderfunction-color— wrapper forfunction-flagcdn-img-fetch— fetcher in the stealer chainimg-to-native— decryptor in the stealer chainnative-runner— wrapper forimg-to-nativetlxbnhd,tldriver, andmxdriver— Overlord RAT loaders
The four packages Checkmarx attributed to the operator but described as non-malicious cover packages were function-ascii, malfapi, malfex-webhook-node, and centralizemiddle. They should not be confused with the eight packages listed above as malicious.
Checkmarx and SecurityWeek reported that function-flag, function-color, and cdn-img-fetch were still installable around October 1, 2026. That is a dated observation, not confirmation of current registry availability. For a version-specific assessment, consult Checkmarx’s affected-package table in its October 5 report; the available findings do not establish the packages’ live status now.
How the three reported delivery paths worked
Install-time loaders for Overlord RAT
According to Checkmarx, tlxbnhd, tldriver, and mxdriver used obfuscated preinstall and postinstall scripts. Those scripts ran as part of npm installation and fetched Windows executable payloads that the report identifies as Overlord RAT. Although the scripts included launch commands for macOS and Linux, Checkmarx describes the payload itself as a Windows executable.
Rank #3
Package-load chain for the movinlike stealer
Checkmarx reports a separate chain involving cdn-img-fetch, img-to-native, and native-runner. In this path, malicious code ran when packages were loaded rather than through an install hook. The resulting movinlike stealer was reported to target Discord clients, browsers, Telegram Desktop session data, and cryptocurrency wallets.
Downloader in function-flag
Checkmarx describes malicious versions of function-flag as fetching payloads from different URLs. The routine could fail silently if a download did not work, while installation could still complete. The report says the host for the function-flag 1.7.3 download was not responding when checked and that its payload had not been recovered; it does not confirm what that variant delivered.
Why an advisory-only scan may miss packages
Checkmarx says six of the eight malicious packages had OSV malware advisories issued between September 22 and 30, 2026. It also identifies gaps: function-flag and function-color had no advisory, while the cdn-img-fetch advisory covered versions 1.0.0 and 1.0.1—not the malicious versions 1.0.2 and 1.0.3. A dependency process that checks only advisory feeds could therefore miss affected package names or versions.
For the package names, roles, affected versions, and technical indicators, use Checkmarx’s report, “MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work,” published October 5, 2026. SecurityWeek’s October 6 report, “Long-Running NPM Malware Campaign Accumulates 40,000 Downloads,” provides an independent news summary. The reported package-status and download observations are time-bound; neither source establishes present-day registry status or independently counted infections.
Best Value
How to find out if you’re impacted
Checkmarx says no legitimate or widely used packages depended on the operator’s packages, so exposure was limited to systems that installed the named packages directly. That narrows the search: look for direct installs and package contents in development, build, and endpoint records rather than treating the campaign’s total downloads as a measure of your organization’s exposure.
- Search project manifests and lockfiles. Look for all eight malicious names:
function-flag,function-color,cdn-img-fetch,img-to-native,native-runner,tlxbnhd,tldriver, andmxdriver. Record any matching version rather than relying on the package name alone. - Check installed dependency trees. Review local and CI/build environments for these names, including installations that may not be reflected in the current manifest or lockfile.
- Review build and endpoint records. If a match appears, establish which machine installed or loaded the package and when. Checkmarx describes both install-time hooks and code that ran when a package was loaded, so checking only whether an install command completed may not resolve exposure.
- Do not rely solely on advisory matches. Compare package names and versions against Checkmarx’s affected-package table because its report documents missing advisories and incomplete version coverage.
What to do if a Windows system installed one
Checkmarx’s guidance is to isolate the Windows host, remove persistence, and rotate exposed credentials from a clean system. The report describes Windows-targeting payloads, even though some loader scripts included cross-platform launch logic. For a response, preserve the package name, version, installation context, and relevant endpoint records so your incident responders can assess the system against the technical indicators in Checkmarx’s report. This article does not independently validate those indicators against live infrastructure.
What the findings establish
The reporting establishes a long-running campaign, eight packages Checkmarx classified as malicious, three distinct delivery paths, and 40,767 npm downloads across those packages by October 1, 2026. It does not establish 40,767 victims, a count of successful infections, current package availability, or the unrecovered payload for function-flag 1.7.3. Developers should therefore treat the package names and versions as actionable leads for local checks—not as proof that a particular machine was compromised.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
