Cybersecurity researchers have uncovered a malicious npm package actively distributed as part of a sophisticated and long-running software supply chain attack campaign known as MALFEX. This latest weaponized component highlights the persistent tactics employed by threat actors targeting developer ecosystems to compromise Windows environments on a broad scale.
The rogue package, identified as "imgdecode," was uploaded to the official npm package registry on September 30, 2026, by a user handle operating under the alias "malfexteste8." Despite its short lifespan in the public repository, analytics indicate that the package has been downloaded nearly a thousand times—specifically 979 times as of the latest tracking—and remains accessible on the platform under its current iteration, version 1.0.3.
According to threat intelligence findings published by cybersecurity firm SafeDep, the "imgdecode" module is engineered to conceal a dangerous malicious loader nested directly within a compiled Node.js native addon. Upon closer inspection, the package features a concise, nine-line JavaScript file whose primary function is to invoke and load a Windows dynamic-link library, commonly referred to as a DLL. When an unsuspecting developer or automated build process executes a Node.js program that calls require('imgdecode') within a Windows console environment, the underlying DLL immediately attempts to reach out to an external GitHub repository. From there, it downloads encrypted shellcode, decrypts the payload locally in memory, and stealthily injects the resulting code into a newly spawned dllhost.exe system process.
The discovery of "imgdecode" fits into a broader threat landscape first mapped out by security analysts at Checkmarx and CloudSEK. These firms initially documented MALFEX as an ongoing, persistent campaign where an unidentified threat actor has systematically published malicious packages to the npm ecosystem since August 6, 2023. The overarching objective of this multi-year campaign is the compromise of Windows-based operating systems. Throughout the operation, malicious artifacts have been deployed across a rotating set of at least five distinct npm publisher handles, including identifiers such as malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4.
Out of an initial batch of eight identified packages tied to the campaign, security investigators discovered that three operated directly as loaders for the Overlord Remote Access Trojan (RAT). Meanwhile, a separate cluster of three packages—namely "cdn-img-fetch," "img-to-native," and "native-runner"—worked in close coordination to download and execute a specialized Node.js information stealer. A third, distinct infection vector relied on postinstall hooks designed to execute JavaScript capable of communicating with an external command-and-control server to retrieve subsequent binary payloads.
Intriguingly, the threat actors orchestrating the MALFEX campaign have demonstrated high adaptability, frequently responding to public security disclosures and swift removals by npm administrators by deploying replacement modules within days. For instance, after security teams flagged "native-runner" and "img-to-native," the operators published substitutes named "runhelper" and "imgbundle" within a 48-hour window. The introduction of "imgdecode" followed this exact operational cadence.
The Node.js information stealer chain within the campaign is particularly notable because none of the involved packages historically relied on traditional install hooks to trigger execution. Instead, the malicious behavior is initiated dynamically when the primary module, "native-runner," is loaded into memory. The package lists "img-to-native" as an explicit dependency, which in turn references related modules in a recursive dependency chain designed to obfuscate execution logic.
Further analysis of the individual utility packages reveals a carefully orchestrated sequence of operations. "Runhelper," which was publicly advertised as a utility helper designed to assist developers in launching native binaries from within Node.js projects, functions as a direct successor to "native-runner." Its core responsibility centers on locating a seemingly benign JPG image file stored at cdn-img-fetch/.runtime/rt.jpg, extracting raw shellcode embedded within the file, allocating executable memory, and invoking the payload using Koffi, a Foreign Function Interface (FFI) module frequently used in Node.js applications.
The evolution of "imgdecode" demonstrates the campaign’s continuous refinement. SafeDep noted that approximately six hours after the "runhelper" package was unpublished by administrators, the threat actors released "imgdecode" incorporating a compiled native DLL to handle shellcode execution. Starting with version 1.0.1, the DLL gained the ability to autonomously download and decrypt the required payload. While versions 1.0.1 and 1.0.2 still explicitly called require('imgbundle') prior to loading the core DLL, version 1.0.3 streamlined the process by removing that dependency entirely, allowing the package to operate independently of other MALFEX modules.
In earlier iterations such as version 1.0.0, "imgdecode" operated similarly to "runhelper" by waiting for "imgbundle" to write data to a local directory path at cdn-img-fetch/.runtime/. Once the target file became available, the package read its contents into memory and passed the raw byte stream to a native Node.js addon intended for data decoding.
The underlying native addon is a 64-bit Microsoft Visual C++ DLL configured to perform environmental checks. Before executing its primary routines, the DLL verifies whether it is operating within a developer terminal or a monitored environment. Upon clearing these checks, it fetches a targeted JPEG file named banner.jpg from a specific GitHub repository hosted under the user account cavecrew/proj. The payload embedded within the image is then decrypted using the hardcoded key nif-runtime-2027 and injected directly into dllhost.exe.
Security researchers noted specific evasion and operational mechanisms built into this decryption phase. According to SafeDep, once the payload is decrypted, the DLL inspects the leading bytes of the resulting plaintext. If the header matches a standard JPEG or PNG signature, the execution halts. This suggests a built-in kill switch or remote configuration capability, allowing the threat actors to temporarily disable the loader by serving encrypted content that safely decrypts into a standard image file, while simultaneously ensuring that serving normal, unencrypted images would cause decryption routines to fail harmlessly before executing malicious code.
Although the associated GitHub account "cavecrew" has since been taken down or rendered inaccessible, historical snapshots recovered from the Internet Archive dating back to October 6, 2026, confirm that the repository hosted a Go-based downloader identical to those used in previous stages of the MALFEX campaign to retrieve information stealers and remote access tools from external infrastructure.
Technical examination of the deployed Node.js application revealed the presence of a configuration .env file containing an active command-and-control server address alongside a MALFEX license key. This finding strongly suggests that the operators are utilizing specialized malware builders or modular licensing frameworks to generate tailored payloads for each wave of the attack.
Once successfully executed on a target machine, the malware initiates a comprehensive series of anti-analysis checks designed to detect virtualized environments, sandboxes, and common debugging or network monitoring utilities such as Process Monitor and Wireshark. Upon verifying that it is running on a genuine host, the malware proceeds to harvest sensitive local data. It targets files matching specific seed phrases and file extensions including .kdbx, .pem, .ppk, and .env, while simultaneously extracting stored credentials, session tokens, and data from Chromium-based web browsers, Discord, Telegram, cryptocurrency wallets, and prominent gaming platforms such as Steam, Epic Games, Riot Games, Battle.net, Minecraft, and Ubisoft.
Furthermore, the payload establishes a persistent WebSocket connection back to the command-and-control server. This persistent communication channel grants the operators remote capabilities including arbitrary shell command execution, file transfer, process control, clipboard monitoring, screen capturing, and remote input injection via simulated mouse and keyboard events. To ensure long-term persistence on compromised Windows systems, the malware automatically creates a Windows Registry Run key alongside a scheduled task titled "MicrosoftEdgeUpdateService."
Security experts strongly advise any software developers or organizations who have inadvertently installed any of the identified MALFEX packages to treat their affected Windows systems as fully compromised. Recommended remediation steps include isolating impacted machines from the network, conducting thorough audits for unauthorized persistence mechanisms, immediately rotating compromised credentials and API keys, and transferring cryptocurrency funds to secure, newly generated wallets if seed phrases or private keys were stored locally on the device.
