MALFEX - A malicious npm postinstall no advisory has caught for fourteen months

This report documents a two-year campaign by a Portuguese-speaking operator publishing malicious and benign npm packages and a GitHub payload repo to run a supply-chain operation: Delivery Arm A uses an IExpress/AutoIt dropper chain to install an Overlord Go RAT (with a live Solana-memo C2 resolver), while Delivery Arm B serves a PNG polyglot that decrypts and delivers a Node.js stealer (movinlike) that injects into Discord and exfiltrates data to an active Discord webhook; the author links the malfexteam2027 key and multiple npm/GitHub handles to the same operator, enumerates active indicators and artifacts, and provides mitigation steps (block specific packages, alert on persistence artifacts, restrict outbound connections, and review dependencies when seizing registry packages).