Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

**Executive Summary:** Researchers disclosed MALFEX, an ongoing npm supply-chain campaign that has published multiple malicious packages (including tlxbnhd, tldriver, mxdriver, function-flag, function-color, and cdn-img-fetch) to deliver Overlord RAT loaders, a Node.js stealer (movinlike) targeting Discord, browsers, Telegram and crypto wallets, and other downloaders via package lifecycle hooks and dependency chaining; the campaign has amassed ~40,767 downloads (notably ~37,419 for function-flag), with several malicious packages still live and payload delivery observed through postinstall scripts and remote hosts.