Malicious "imgdecode" npm Package Uncovered in Ongoing MALFEX Supply Chain Campaign

Cybersecurity researchers have uncovered a malicious npm package disguised as an image decoding utility, marking the latest evolution in an ongoing software supply chain attack campaign tracked under the codename MALFEX. The package, which targets Windows environments, highlights the persistent and adaptive nature of modern threat actors targeting open-source software registries to deploy remote access tools and information stealers.

The package in question, titled "imgdecode," was uploaded to the official npm package registry on September 30, 2026, by a user operating under the handle "malfexteste8." According to public metrics, the package had accumulated 979 downloads by the time of its discovery and remained publicly available on the platform in its version 1.0.3 release. Cybersecurity analysis from SafeDep revealed that the package conceals a malicious loader inside a compiled Node.js native addon. A concise nine-line JavaScript file forms the core of the package, responsible for loading a Windows dynamic-link library. When a Node.js application calls require('imgdecode') within a Windows console environment, the embedded dynamic-link library attempts to establish contact with GitHub to download encrypted shellcode, which is subsequently decrypted and injected directly into a newly spawned dllhost.exe process.

The MALFEX campaign itself was first documented by security researchers at Checkmarx and CloudSEK. It represents a long-running, coordinated operation in which an unidentified threat actor has systematically published malicious packages to the npm ecosystem since August 6, 2023. The primary objective of these efforts is the systematic compromise of Windows-based systems. Throughout the campaign, the threat actors have utilized multiple publisher handles, including malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4, to distribute their malicious code.

Initial investigations into the campaign identified eight distinct packages. Among them, three were found to function as specialized loaders for the Overlord RAT, a notorious remote access trojan. Three additional packages—named "cdn-img-fetch," "img-to-native," and "native-runner"—operated in tandem to download and execute a Node.js-based information stealer. An alternative infection vector deployed by the threat actors involved leveraging postinstall hooks to execute arbitrary JavaScript capable of reaching out to external command-and-control infrastructure to retrieve unspecified next-stage binaries.

Subsequent tracking indicates that the threat actor behind MALFEX actively monitors public security disclosures and the removal of malicious packages by npm administrators. Demonstrating a high degree of agility, the operator routinely publishes replacement packages within days of a takedown. For instance, following the removal of "native-runner" and "img-to-native," the operator introduced substitutes named "runhelper" and "imgbundle," closely followed by the initial release of "imgdecode."

The technical architecture of the Node.js stealer chain is notable for its deliberate omission of standard installation hooks. Instead of executing code during the installation phase, the malicious behavior triggers immediately when the "native-runner" module is loaded into memory. The package lists "img-to-native" as a direct dependency, creating an internal dependency loop designed to obfuscate execution flows.

Analysis of "Runhelper," which was publicly advertised as a utility for launching native binaries from Node.js projects, demonstrated that it functions similarly to "native-runner." Its primary operational directive is to locate a specific JPEG file stored locally at cdn-img-fetch/.runtime/rt.jpg, extract raw shellcode embedded within the file, copy it into executable memory space, and execute it using Koffi, a Foreign Function Interface module designed for Node.js.

As security interventions disrupted these packages, the threat actor pivoted. Approximately six hours after the "runhelper" package was unpublished, the operator introduced "imgdecode," incorporating a compiled dynamic-link library specifically engineered to handle shellcode execution. Starting with version 1.0.1, the dynamic-link library assumed the added responsibility of downloading and decrypting the final payload independently. While early iterations—versions 1.0.1 and 1.0.2—continued to invoke require('imgbundle') prior to loading the dynamic-link library, version 1.0.3 successfully streamlined the process by removing that external dependency entirely, allowing the package to operate without relying on any other components of the MALFEX ecosystem.

In its earliest release, version 1.0.0 of "imgdecode" waited passively for "imgbundle" to write data to a local directory at cdn-img-fetch/.runtime/. Once the file became available, the package read its contents into memory and handed them off to a native Node.js addon designed to decode the payload. This native addon is a 64-bit Microsoft Visual C++ dynamic-link library that performs environmental checks to confirm it is executing within a standard developer terminal before proceeding. Upon verification, it fetches a file named banner.jpg from a specific GitHub repository associated with the handle "cavecrew/proj." It then decrypts the hidden payload using a hardcoded key, nif-runtime-2027, and injects the resulting code into dllhost.exe.

Security analysts noted specific operational characteristics within the decryption routine. Following the decryption phase, the dynamic-link library inspects the initial bytes of the resulting plaintext data. If the header matches a standard JPEG or PNG file signature, the execution halts. Researchers deduce from this behavior that the operator maintained a remote kill-switch mechanism, allowing them to effectively deactivate the loader at will by serving encrypted content that safely decrypted back into a standard image file, whereas serving legitimate image data normally would cause the decryption process to fail prior to reaching the signature verification check.

Although the GitHub account "cavecrew" has since been taken offline and rendered inaccessible, archived historical records from early October preserved evidence of the file’s structure. The retrieved asset matched a Go-based downloader previously observed fetching the Node.js stealer and a remote access tool known as "movinlike" from an external IP address. Furthermore, inspection of the associated Node.js application revealed a configuration file containing a command-and-control server address alongside a MALFEX license key, pointing to the use of a commercial or custom malware builder framework.

The deployed malware incorporates extensive anti-analysis mechanisms designed to detect virtualized environments, sandboxes, and administrative debugging tools such as Wireshark and Process Monitor. Once confirmed to be running on a genuine host, the malware systematically scans the compromised system for sensitive files, targeting specific extensions including .kdbx, .pem, .ppk, and .env, alongside seed phrases associated with cryptocurrency wallets. It also harvests credential and session data from Chromium-based web browsers, Discord, Telegram, and major gaming platforms such as Steam, Epic Games, Riot, Battle.net, Minecraft, and Ubisoft.

Beyond data exfiltration, the malware establishes an active WebSocket connection with its command-and-control server, granting the remote operator capabilities to execute arbitrary shell commands, transfer files, control active processes, capture clipboard contents, take screenshots, and simulate mouse and keyboard input. To ensure persistence across reboots, the malware establishes persistence by writing a Registry Run key and registering a malicious scheduled task under the guise of a routine software update service named "MicrosoftEdgeUpdateService."

Security professionals advise developers who may have inadvertently installed any of the associated packages to treat their Windows workstations as fully compromised. Recommended remediation steps include isolating affected machines from the network, auditing the system for persistence mechanisms, rotating all compromised credentials immediately, and transferring digital assets to secure wallets if cryptocurrency seed phrases were stored on the impacted machine.