Quick scope note first, because I don’t want to oversell this. CloudSEK’s report on MALFEX has no AI-agent angle. It’s a plain npm supply-chain campaign. I’m covering it because every coding agent I write about runs npm install on a developer’s behalf, so it affects the same people.
What CloudSEK found
- A single operator behind at least 12 npm packages. Five carry malware advisories, three are malicious but had none, and four are harmless “cover” tools.
- One package,
function-flag, had a malicious install script since July 18, 2025. The report says it went unadvised for fourteen months. - At the time of writing, three packages were still active threats:
function-flag,cdn-img-fetchandfunction-color.
An aggregator summary I saw put the combined downloads above 40,000. I couldn’t find that figure in CloudSEK’s own write-up, so treat it as unconfirmed.
How the attack works
The trick is the postinstall script, which npm runs automatically when you install a package. In one delivery path, it downloads a Windows executable disguised as a PNG, unpacks a signed AutoIt interpreter plus an encrypted script, and drops an open-source Go remote-access tool. That tool finds its command server through a live Solana blockchain lookup, which makes it harder to block by taking down one domain. In the other path, the malware steals browser data, Discord credentials and Telegram session data and sends them out through a Discord webhook.
It’s Windows-focused, so macOS and Linux users are less exposed to this specific payload, but the delivery method is not platform-specific.
Why it stayed hidden
The detail I find most useful is the evasion record. Four of the 12 packages are harmless on purpose, which makes the operator’s account look like an ordinary hobbyist who publishes small utilities. And a package that was taken down can still leave other pieces online: CloudSEK’s own recommendation is to inspect all declared dependencies whenever a registry package is removed, so that active components don’t stay up after the “main” one is gone. Takedowns are not the same as cleanup.
What to do
CloudSEK’s advice is for defenders: block the three packages, watch for the persistence files and scheduled task it lists, and restrict outbound traffic to the payload hosts.
For the rest of us, one general habit covers a lot of this class of attack:
npm config set ignore-scripts true
That stops install scripts from running automatically. Some legitimate packages need them, so you’ll occasionally have to run a build step by hand, but it removes the whole “install equals code execution” path. If you let an agent install dependencies for you, this matters more, because nobody is reading the package name. I wrote about a related risk in the slopsquatting post and about stolen agent credentials in this one.
Source: CloudSEK.
