Researchers have found a malicious npm package called "imgdecode" that belongs to the MALFEX software supply chain campaign, according to SafeDep. The package was uploaded on September 30, 2026, by the user "malfexteste8," has been downloaded 979 times, and remains available on npm, with version 1.0.3 as the latest.
SafeDep said the package hides a malicious loader in a compiled Node.js addon. Its nine-line JavaScript file loads a Windows DLL, and when a Node.js program calls require('imgdecode') from a Windows console, the DLL tries to download encrypted shellcode from GitHub, decrypts the response, and injects the result into a new dllhost.exe process.
MALFEX was first documented by Checkmarx and CloudSEK as a long-running campaign in which an unknown threat actor has published malicious packages to npm since August 6, 2023, targeting Windows systems across five publisher handles: malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4. Of the eight identified packages, three acted as a loader for Overlord RAT, while three others - cdn-img-fetch, img-to-native, and native-runner - worked together to download and run a Node.js stealer. A third pathway used a postinstall hook to run JavaScript that contacted an external server for an unspecified next-stage binary.
The actor appears to respond to public disclosures and npm removals by publishing replacements. "native-runner" and "img-to-native" were removed on September 28, 2026, and replacements "runhelper" and "imgbundle" appeared on September 30, the same day the first version of "imgdecode" was published. "Runhelper" was unpublished that day, and SafeDep noted that six hours later the operator published "imgdecode" with a compiled DLL to run the shellcode. From version 1.0.1, the DLL also downloads and decrypts the payload; versions 1.0.1 and 1.0.2 still called require('imgbundle'), while version 1.0.3 removes that dependency and needs no other MALFEX package.
The addon is a 64-bit Microsoft Visual C++ DLL that first checks whether it is running in a developer's terminal, then fetches a JPG file ("banner.jpg") from the repository "cavecrew/proj," decrypts the embedded payload using the key "nif-runtime-2027," and injects the output into "dllhost.exe." SafeDep said the DLL checks the first bytes of the plaintext after decryption and stops if they match a JPEG or PNG signature, suggesting the operator could disable the loader by serving encrypted content that decrypts to an image.
The Node.js application includes a .env file with a command-and-control address ("104.234.65[.]75:7007") and a MALFEX license key, indicating a malware builder or licensing system. The malware runs anti-analysis checks for virtual machines, sandboxes, and tools including Process Monitor and Wireshark before harvesting files matching seed phrases and specific extensions (.kdbx, .pem, .ppk, and .env), plus data from Chromium-based browsers, Discord, Telegram, cryptocurrency wallets, and gaming apps. It can open a WebSocket connection to the C2 server for shell execution, file transfer, process control, clipboard access, screenshots, and mouse and keyboard input, and adds a Registry Run key and a scheduled task named "MicrosoftEdgeUpdateService" for persistence.
Developers who installed any of these packages should treat their Windows systems as potentially compromised, isolate them, check for persistence entries, rotate credentials, and move funds to new wallets if seed phrases were stored in them.
Source: The Hackers News