MALFEX npm malware packages reportedly top 40,000 downloads

SecurityWeek, citing Checkmarx, reports that malicious packages in the MALFEX npm campaign accumulated over 40,000 downloads. The campaign began in August 2023 and distributed malware including the Overlord remote-access trojan and information stealers. Of 12 packages published, eight were malicious; three remained installable as of October 1. One package, function-flag, had over 37,000 downloads and no advisory flagging it as malicious.