Malicious "imgdecode" npm Package Discovered in Ongoing MALFEX Software Supply Chain Campaign

Cybersecurity researchers have uncovered a newly identified malicious npm package actively circulating within the open-source software ecosystem. The package is the latest weapon in a persistent and evolving software supply chain attack campaign tracked under the codename MALFEX, which has systematically targeted Windows systems over a prolonged period.

The offending package, distributed under the name "imgdecode," was uploaded to the official npm package registry on September 30, 2026, by a publisher operating under the handle "malfexteste8." Security telemetry indicates that the package managed to record nearly a thousand downloads—specifically 979 times—prior to public reporting, remaining accessible within the registry as developers continued to query the repository. The latest version flagged by security analysts is version 1.0.3, continuing a lineage of iterative updates designed to evade automated detection and bypass security controls.

According to a detailed technical analysis published by the cybersecurity firm SafeDep, the "imgdecode" npm package cleverly conceals a malicious payload within a compiled Node.js native addon. The package relies on a remarkably concise nine-line JavaScript file that acts as a bridge to load a Windows dynamic-link library, commonly known as a DLL. When an unsuspecting Node.js application triggers a require('imgdecode') command within a Windows console environment, the underlying DLL initiates an outbound request to fetch encrypted shellcode directly from GitHub. Upon retrieval, the library decrypts the binary payload and injects the resulting code straight into a newly spawned dllhost.exe process, allowing the attacker to execute arbitrary code covertly beneath the operating system’s radar.

The MALFEX campaign itself was initially brought to light through collaborative documentation efforts by threat intelligence researchers at Checkmarx and CloudSEK. Investigators established that MALFEX represents a long-running, coordinated operation where an unidentified threat actor has continuously published malicious packages to the npm ecosystem since August 6, 2023. These malicious contributions have been distributed across multiple publisher accounts, including handles such as malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4, demonstrating a sustained and deliberate effort to compromise Windows-based developer environments.

Prior analysis of the broader MALFEX campaign identified at least eight distinct malicious packages deployed by the threat actor. Among these initial vectors, three packages were engineered specifically to act as loaders for the Overlord Remote Access Trojan (RAT). Meanwhile, a separate cluster of three packages—specifically named "cdn-img-fetch," "img-to-native," and "native-runner"—collaborated closely to download and execute a sophisticated Node.js-based information stealer. An alternative infection pathway identified by researchers involved the deployment of a postinstall hook designed to execute arbitrary JavaScript capable of reaching out to external command-and-control servers to fetch unspecified next-stage binaries.

Investigative findings highlight the adaptive nature of the threat actor behind MALFEX, who has frequently responded to public security disclosures and subsequent package removals by rapidly deploying functional replacements. For instance, after security teams flagged "native-runner" and "img-to-native," the operator published alternative packages named "runhelper" and "imgbundle" within a remarkably tight window of just two days. The introduction of "imgdecode" followed this exact operational cadence as the threat actor continued to refine their delivery mechanisms.

The Node.js stealer chain deployed in these attacks is particularly notable because the constituent packages intentionally omit conventional install hooks. Instead, the malicious behavior is triggered dynamically when the primary package, "native-runner," is loaded into memory. The package explicitly lists "img-to-native" as a dependency, creating a circular or nested reference structure designed to obscure the execution flow from casual inspection.

Security analyses of individual packages in the ecosystem reveal specialized roles within the broader attack chain. The package known as "Runhelper," which was publicly advertised under the benign guise of a utility helper for launching native binaries from within Node.js projects, functions similarly to "native-runner" by executing malicious code directly. Its primary operational objective is to locate a specific JPEG file stored locally at cdn-img-fetch/.runtime/rt.jpg, extract raw shellcode embedded within the image data, copy that code into executable memory space, and execute it utilizing Koffi, which serves as a Foreign Function Interface (FFI) module for Node.js.

The evolution of the "imgdecode" package reflects a distinct shift toward modular independence. According to SafeDep, approximately six hours after the "runhelper" package was unpublished by repository administrators, the operator published "imgdecode," incorporating a compiled DLL designed to handle shellcode execution directly. Beginning with version 1.0.1, the DLL assumed full responsibility for downloading and decrypting the payload independently. While versions 1.0.1 and 1.0.2 retained a dependency that called require('imgbundle') before loading the DLL, version 1.0.3 completely stripped away that external dependency, rendering "imgdecode" entirely self-contained and free from reliance on other packages associated with the MALFEX campaign.

In its earlier iterations, specifically version 1.0.0, "imgdecode" functioned similarly to its predecessors by waiting for "imgbundle" to write a file into the cdn-img-fetch/.runtime/ directory. Once the target file became available, the package read its contents directly into memory and transferred the data to a native Node.js addon intended for decoding purposes.

The underlying native addon itself is a 64-bit Microsoft Visual C++ DLL that incorporates environmental checks. Upon execution, the DLL first verifies whether it is operating within a developer terminal environment. If the checks pass, it proceeds to fetch a legitimate-looking banner image file named banner.jpg from a specific GitHub repository associated with the handle "cavecrew/proj." The DLL then decrypts the hidden payload embedded within the image using a hardcoded cryptographic key string, "nif-runtime-2027," before injecting the resulting code into the legitimate Windows system process dllhost.exe.

Security researchers noted clever evasion tactics integrated into the decryption routine. SafeDep explained that after decrypting the retrieved data, the DLL inspects the initial bytes of the resulting plaintext. If the signature matches standard JPEG or PNG file formats, the DLL halts its execution. This mechanism suggests that the threat actor could remotely deactivate the active loader at will simply by serving encrypted content that decrypts back into a benign image file, whereas serving a standard, unencrypted image would naturally cause the decryption process to fail prior to reaching the signature verification check.

Although the GitHub account "cavecrew" associated with the repository has since been taken down and rendered inaccessible, historical records preserved via Internet Archive snapshots dating back to early October 2026 confirmed that the hosting location distributed the exact Go-based downloader used to pull down the Node.js information stealer and the "movinlike" remote access tool from an external infrastructure IP address. Furthermore, inspection of the recovered Node.js application revealed an embedded environment configuration file containing a specific command-and-control server address alongside a MALFEX license key. This artifact strongly indicates that the attackers made use of an automated malware builder or commercial-style licensing framework to generate and manage their malicious payloads.

Before executing its primary data-harvesting routines, the malware incorporates robust anti-analysis capabilities. It actively audits the host system for signs of virtualization, sandbox environments, and common security analysis tools, including Process Monitor and Wireshark. Once it confirms the environment is safe to proceed, the payload targets valuable user assets, scanning for files matching specific sensitive seed phrases and file extensions such as .kdbx, .pem, .ppk, and .env. Additionally, the threat actor’s creation harvests stored credentials, session tokens, and local data from Chromium-based web browsers, Discord, Telegram, various cryptocurrency wallets, and prominent gaming platforms, including Steam, Epic Games, Riot Games, Battle.net, Minecraft, and Ubisoft.

Beyond simple credential harvesting, the malware establishes an active WebSocket connection back to the operator’s command-and-control infrastructure. This persistent communication channel grants the attacker remote capabilities, including arbitrary shell command execution, file transfer operations, process monitoring and control, clipboard interception, screenshot capture, and remote manipulation of mouse and keyboard inputs. To ensure long-term persistence across system reboots, the malware automatically writes a Registry Run key into the Windows registry and configures a malicious scheduled task masquerading under the innocuous name "MicrosoftEdgeUpdateService."

Given the severity of the threat landscape presented by the MALFEX campaign, cybersecurity authorities strongly advise developers and system administrators who may have installed any of the implicated npm packages to treat their Windows systems as fully compromised. Affected organizations should immediately isolate impacted workstations, perform comprehensive forensic audits for persistence mechanisms, rotate all exposed credentials and API keys, and transfer cryptocurrency assets to newly generated secure wallets if seed phrases or private keys were stored locally on the machine.