MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work

**MALFEX** is an ongoing npm supply‑chain malware campaign attributed to a single operator that has published 12 packages since August 2023 (eight malicious). The malicious packages use npm install hooks and runtime loads to deliver an Overlord RAT loader, the movinlike stealer (exfiltrating to a Discord webhook), and persistent downloaders (notably function-flag), primarily targeting Windows; ~40,767 malicious package downloads were recorded and several malicious versions remain live with incomplete advisory coverage. The report includes IOCs (URLs, hashes, host artifacts), detection commands, persistence details, and step‑by‑step remediation and blocking recommendations.