An npm Placeholder Does Not Clear Your Build History
A package record describes the registry now. It cannot establish what an earlier build downloaded or what a workstation subsequently ran. That distinction changes how teams should read the three npm records examined in BlackTree’s original MALFEX report.
Updated 15 October 2026: The records for function-flag, function-color and cdn-img-fetch now expose only 0.0.0-stage and 0.0.1-security. Each latest tag selects the latter, described as a security holding package. Their recorded changes date from 7 or 8 October.
OSV published MAL-2026-17648 for function-flag and MAL-2026-17647 for function-color on 7 October. The cdn-img-fetch record, MAL-2026-17320, was revised on 8 October: its range begins at zero, with 1.0.0, 1.0.1 and 1.0.3 explicitly listed. The earlier advisory-gap description is therefore out of date.
Keep the original observation in its proper time
Our 6 October checks found latest at 1.7.3 for the first two names and 1.0.4 for the third. Those were then-current tags, not today’s registry state.
Checkmarx’s 5 October analysis identifies eight malicious packages: function-flag, function-color, cdn-img-fetch, img-to-native, native-runner, tlxbnhd, tldriver and mxdriver. Its table lists cdn-img-fetch 1.0.0–1.0.3, not 1.0.4. An omitted version is not a clean-version finding, and OSV’s explicit version list is not its entire range.
The research describes Windows install-hook RAT or downloader paths and a separate load-time stealer chain. Disabling install scripts with --ignore-scripts does not stop the latter. Registry containment therefore cannot answer whether a historical installation executed malicious code.
Reconstruct the build before accepting the recovery
Consider a hypothetical team with an old release branch and a freshly rebuilt default branch. The current build succeeds, while a developer still works from the earlier checkout. Treat those as separate investigation targets. A reassuring result for one does not explain the other’s dependency history.
Checkmarx recommends reviewing the resolved tree, lockfiles and retained caches, isolating affected Windows hosts and rotating exposed credentials from a clean system. It advises blocking specific malicious paths rather than entire shared GitHub or Discord services. Preserve relevant evidence before cleanup.
For each affected project, give the investigation an owner and record the package version, resolution time, machine and available execution evidence. Explain gaps instead of silently treating missing logs as a clean result. The dependency owner can confirm a replacement build; the incident lead must separately decide what earlier activity means.
The current registry records establish holding-package metadata, not infection or the availability of an attacker’s server. BlackTree has not contacted payload endpoints or downloaded the suspect releases. Use the linked malware advisories and dated research without inventing a CVE identifier or assuming every historical version behaved alike.
For a different execution pattern, see BlackTree’s separate npm runtime case. That reporting is context, not evidence that the incidents share an operator.
