Malicious "imgdecode" npm Package Uncovered in Ongoing MALFEX Software Supply Chain Campaign

Cybersecurity researchers have uncovered a newly identified malicious npm package actively targeting Windows environments as part of an ongoing, sophisticated software supply chain attack campaign designated under the codename MALFEX.

The compromised component, distributed under the unassuming name "imgdecode," was uploaded to the official npm package registry on September 30, 2026, by a publisher account operating under the handle "malfexteste8." Despite continuous tracking and ongoing advisories from the cybersecurity community, the package has accumulated nearly a thousand downloads—specifically 979 as of the time of writing—and remains publicly available on the platform in its latest iteration, version 1.0.3.

According to a technical analysis published by security firm SafeDep, the "imgdecode" package conceals a malicious loader deeply embedded inside a compiled Node.js native addon. While its top-level JavaScript file appears deceptively brief at just nine lines of code, its sole purpose is to quietly load a Windows dynamic-link library, commonly known as a DLL. When a targeted Windows console executes a Node.js application that calls require('imgdecode'), the underlying DLL springs into action, attempting to silently download encrypted shellcode from an external GitHub repository. Once retrieved, the DLL decrypts the payload in memory and injects the resulting code directly into a legitimate Windows system process, specifically dllhost.exe, allowing the attacker to blend in with normal operating system traffic.

The discovery of "imgdecode" builds upon a series of earlier warnings initially disclosed by threat intelligence teams at Checkmarx and CloudSEK. These organizations first brought to light the MALFEX campaign, a long-running and persistent supply chain operation orchestrated by an anonymous threat actor. Since August 6, 2023, the perpetrator has systematically flooded the npm registry with malicious packages specifically tailored to compromise Windows operating systems. Over the course of the campaign, these malicious artifacts have been distributed across a rotating array of five distinct npm publisher handles, including malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4.

Out of an initial cohort of eight identified malicious packages associated with the campaign, investigators discovered that three functioned explicitly as loaders for the Overlord Remote Access Trojan (RAT). Meanwhile, a separate trio of packages—comprising cdn-img-fetch, img-to-native, and native-runner—operated in tandem to download and execute a sophisticated Node.js-based information stealer. An alternative infection vector observed within the campaign relied on utilizing a package postinstall hook to execute arbitrary JavaScript capable of reaching out to an external server to retrieve an unspecified, next-stage binary payload.

Intriguingly, threat intelligence observations indicate that the threat actor behind MALFEX is closely monitoring public security disclosures and registry removals, actively adapting their tactics in real time. Following the takedown of the native-runner and img-to-native packages, the operator swiftly published replacements named runhelper and imgbundle within a mere 48-hour window. On that exact same day, the very first version of imgdecode was pushed to the registry, demonstrating a high degree of agility and resilience on the part of the attacker.

The infection chain involving the Node.js information stealer is particularly notable because none of the associated packages feature a traditional installation hook. Instead, the malicious behavior is triggered dynamically when the native-runner package is explicitly loaded by an application. This package lists img-to-native as a core dependency, which in turn relies on further internal structures to execute its payload.

Further analysis of the individual components reveals a modular and evolving architecture. The package designated as runhelper, which was publicly advertised on the registry as a utility helper for launching native binaries from within Node.js projects, functions similarly to its predecessor by facilitating the execution of malicious code. Its core operational responsibility involves locating a specific JPG file stored locally at cdn-img-fetch/.runtime/rt.jpg, extracting embedded shellcode from the image data, copying it directly into executable memory spaces, and running it using Koffi, a Foreign Function Interface module designed for Node.js environments.

The evolution of the campaign’s loader mechanism became even more apparent shortly after runhelper was removed from the registry. Just six hours later, the operator published imgdecode utilizing a compiled DLL specifically engineered to run the extracted shellcode. Beginning with version 1.0.1, the DLL was updated to independently handle the downloading and decryption of the payload. While versions 1.0.1 and 1.0.2 still invoked require('imgbundle') prior to loading the DLL, version 1.0.3 successfully streamlined the process by removing that dependency entirely, allowing imgdecode to operate as a standalone MALFEX package.

Similar to the operational logic seen in runhelper, version 1.0.0 of imgdecode initially waited for imgbundle to write a file to the cdn-img-fetch/.runtime/ directory. Once the file became available, the package would read its contents into system memory and pass the data to a native Node.js addon designed to decode it.

The underlying native addon itself is a 64-bit Microsoft Visual C++ dynamic-link library that first conducts environmental checks to determine whether it is executing inside a developer’s terminal. If conditions are met, it proceeds to fetch a file named banner.jpg from a remote repository hosted under the username cavecrew/proj. It then decrypts the embedded payload using a hardcoded cryptographic key, nif-runtime-2027, and injects the resulting code into dllhost.exe.

Security researchers noted an ingenious evasion mechanism built into the loader’s decryption routine. After performing the decryption process, the DLL inspects the leading bytes of the plaintext output. If the bytes correspond to a standard JPEG or PNG file signature, the DLL halts execution. This implementation suggests that the threat actor maintained a remote kill-switch, allowing them to effectively neutralize the loader on compromised machines simply by serving ordinary, non-malicious image content that would result in a benign decryption output. Serving standard images would otherwise cause normal decryption validation to fail, rendering the injection harmless.

Although the GitHub account operating under the alias cavecrew has since been taken down and made inaccessible, historical records captured by the Internet Archive on October 6, 2026, confirm that the repository hosted the exact same Go-based downloader used to retrieve the Node.js information stealer and the remote access tool known as movinlike from an external infrastructure point located at 104.234.65[.]75:700.

Examination of the recovered Node.js application revealed an internal environment configuration file containing a hardcoded command-and-control server address set to 104.234.65[.]75:7007 alongside an embedded MALFEX license key. This discovery strongly suggests that the threat actor is leveraging an automated malware builder or commercial-style licensing framework to rapidly generate and deploy these customized payloads.

Once successfully deployed on a target machine, the malware initiates rigorous anti-analysis checks designed to detect the presence of virtualized environments, sandboxes, and common administrative analysis tools such as Process Monitor and Wireshark. Upon verifying that it is running on a genuine host, the malware immediately begins harvesting sensitive information, targeting files matching specific seed phrases and high-value extensions including .kdbx, .pem, .ppk, and .env. It also extracts cached credentials, cookies, and session data from Chromium-based web browsers, Discord, Telegram, various cryptocurrency wallets, and prominent gaming platforms such as Steam, Epic Games, Riot, Battle.net, Minecraft, and Ubisoft.

Furthermore, the payload establishes a persistent WebSocket connection back to the command-and-control server, granting the operator remote capabilities that include executing arbitrary shell commands, transferring files, managing active processes, capturing clipboard contents, taking desktop screenshots, and remotely controlling mouse and keyboard input. To maintain access across system reboots, the malware establishes persistence by adding a Registry Run key and generating a scheduled task deceptively disguised under the name MicrosoftEdgeUpdateService.

Security professionals strongly advise any software developers who may have inadvertently downloaded or integrated any of the aforementioned packages to treat their Windows systems as fully compromised. Affected organizations should immediately isolate impacted machines, thoroughly audit systems for unauthorized persistence mechanisms, rotate all compromised administrative credentials and API keys, and transfer cryptocurrency assets to secure, newly generated wallets if seed phrases were stored on the impacted devices.