Cybersecurity researchers have uncovered a newly identified malicious npm package actively distributed as part of a sophisticated and long-running software supply chain attack campaign tracked under the designation MALFEX. This ongoing threat underscores the persistent risks facing developers who rely on open-source package registries to build modern software applications.
The newly analyzed package, registered under the name "imgdecode," was uploaded to the official npm package registry on September 30, 2026, by a user profile operating under the handle "malfexteste8." According to public registry statistics, the package accumulated nearly a thousand downloads—specifically 979 times—prior to public awareness, remaining publicly accessible on the npm repository. The most recent iteration of this malicious library was cataloged as version 1.0.3.
Detailed technical analysis conducted by cloud security and supply chain firm SafeDep revealed that the package conceals a malicious loader deeply integrated within a compiled Node.js native addon. In its underlying architecture, a compact nine-line JavaScript file is tasked with loading an external Windows dynamic-link library, commonly referred to as a DLL. When an unsuspecting developer or a vulnerable Node.js application invokes a standard require('imgdecode') command within a Windows environment, the underlying DLL immediately triggers an outbound connection attempt. This network request aims to download encrypted shellcode hosted on external infrastructure, specifically GitHub. Upon successfully retrieving this data, the module decrypts the response and performs a process injection technique, pushing the resulting payload directly into a newly spawned dllhost.exe system process.
The broader MALFEX campaign was initially brought to light through comprehensive intelligence reports published by security researchers at Checkmarx and CloudSEK. These investigations exposed a persistent threat actor who has systematically published malicious software packages to the npm ecosystem since August 6, 2023. The primary objective of this prolonged campaign has been the systematic compromise of Windows-based operating systems. To obscure their activities and evade automated security filters, the malicious actors distributed these packages across a rotating array of distinct npm publisher handles, including malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4.
Out of an initial cohort of eight identified packages, investigators determined that three served as dedicated loaders for the Overlord Remote Access Trojan, commonly known as RAT. Meanwhile, a trio of other packages—named "cdn-img-fetch," "img-to-native," and "native-runner"—operated in tandem to download and execute a specialized Node.js-based information stealer. An alternative infection vector deployed by the threat actors involved the implementation of a postinstall hook mechanism designed to execute arbitrary JavaScript code capable of communicating with an external command-and-control server to retrieve subsequent binary stages.
Intriguingly, operational tracking indicates that the threat actor behind MALFEX actively monitors public security disclosures and administrative removals by the npm registry. In response to the takedown of security-flagged libraries, the operators rapidly deployed functional replacements. For instance, within a span of just two days following the exposure of "native-runner" and "img-to-native," the actors published substitute packages named "runhelper" and "imgbundle," quickly followed by the introduction of the initial versions of "imgdecode."
The architectural design of the Node.js stealer chain exhibits notable evasion tactics, notably omitting standard install hooks in favor of executing malicious routines dynamically upon the explicit loading of the "native-runner" module. This package lists "img-to-native" as a core dependency, which in turn references additional internal dependencies to establish the execution chain.
Among the specific components identified in the attack framework, a package named "runhelper," which was publicly marketed as a utility helper designed to assist developers in launching native binaries from within Node.js environments, operates similarly to its predecessor "native-runner." Its primary functional responsibility involves locating a specific JPG file stored at "cdn-img-fetch/.runtime/rt.jpg," extracting embedded shellcode from the image data, allocating executable memory space, and executing the code utilizing Koffi, an advanced Foreign Function Interface module tailored for Node.js applications.
Security insights from SafeDep highlight the rapid iteration of the threat actor’s codebase. Just six hours after the "runhelper" package was unpublished from the registry, the operator published "imgdecode," featuring a compiled dynamic-link library engineered to execute the required shellcode. Beginning with version 1.0.1, the DLL gained the native capability to independently download and decrypt its operational payload. Furthermore, early versions including 1.0.1 and 1.0.2 retained a dependency that required calling require('imgbundle') prior to initializing the DLL loader. However, version 1.0.3 streamlined the architecture by removing this external dependency entirely, allowing the package to operate independently of any other MALFEX components.
Similar to the operational flow observed in "runhelper," version 1.0.0 of "imgdecode" was designed to wait until the "imgbundle" package successfully wrote a file into the local "cdn-img-fetch/.runtime/" directory. Once the target file became available, the application read its raw contents into system memory and transmitted the data to a native Node.js addon configured to process and decode the payload.
The underlying native addon is a 64-bit Microsoft Visual C++ DLL configured to perform environmental checks. It initially verifies whether it is executing inside a developer’s active terminal or an ordinary user environment before reaching out to fetch a seemingly benign image file, specifically "banner.jpg," hosted within a designated GitHub repository under the user account "cavecrew/proj." Once retrieved, the DLL decrypts the embedded payload utilizing a hardcoded encryption key, "nif-runtime-2027," before injecting the resulting code directly into the legitimate dllhost.exe system process.
Further analysis of the decryption routine revealed operational safeguards implemented by the threat actors. According to SafeDep, once the payload is decrypted, the DLL inspects the initial bytes of the resulting plaintext. If the signature aligns with standard JPEG or PNG file headers, the DLL halts its execution path. Security researchers deduce that this mechanism allows the threat actor to remotely deactivate active loaders by serving standard, non-malicious encrypted content that successfully decrypts into a genuine image, whereas serving ordinary image files would typically cause standard decryption operations to fail prior to reaching this verification check.
Although the associated GitHub repository under the handle "cavecrew" has since been taken down and rendered inaccessible, historical snapshots preserved by the Internet Archive from early October 2026 confirm that the repository hosted a Go-based downloader identical to those utilized in previous campaigns to retrieve the Node.js stealer and associated remote access tools from remote infrastructure located at 104.234.65[.]75:700.
Examination of the deployed Node.js application revealed an internal environment file containing a dedicated command-and-control server address alongside a MALFEX license key, pointing to the potential utilization of a broader malware development kit or commercial-style licensing framework for generating custom payloads.
Once successfully established on a target system, the malware initiates a comprehensive suite of anti-analysis routines. It audits the local environment for indications of virtualization, sandboxed execution, and common administrative or security monitoring software, such as Process Monitor and Wireshark. Upon confirming the environment is suitable, the malware proceeds to harvest sensitive data, targeting files matching specific seed phrases and high-value extensions including .kdbx, .pem, .ppk, and .env. It also extracts stored credentials, session tokens, and configuration data from popular Chromium-based web browsers, communication platforms like Discord and Telegram, cryptocurrency wallet installations, and major gaming client platforms such as Steam, Epic Games, Riot Games, Battle.net, Minecraft, and Ubisoft.
Beyond simple credential harvesting, the implant establishes a persistent WebSocket connection back to the command-and-control infrastructure, granting the remote operator full interactive capabilities. These include remote shell execution, file transfer operations, process management, clipboard data collection, automated screen capture, and remote control of mouse and keyboard inputs. To ensure long-term persistence across system reboots, the malware establishes registry persistence by writing to Windows Run keys alongside the creation of a malicious scheduled task masquerading as a legitimate system update process under the name "MicrosoftEdgeUpdateService."
Security professionals strongly advise that any software development environments or individual Windows systems that have installed any of the identified MALFEX-related packages should be treated as fundamentally compromised. Affected organizations are urged to immediately isolate impacted systems from internal networks, conduct thorough forensic audits for persistence artifacts, systematically rotate all compromised access credentials and API keys, and secure cryptocurrency assets by transferring funds to newly generated wallets if seed phrases were potentially exposed to the harvested data streams.
