Cybersecurity researchers have uncovered a freshly minted malicious npm package masquerading as an image-decoding utility, marking the latest escalation in an ongoing software supply chain attack campaign tracked under the codename MALFEX.
The malicious package, published under the deceptively benign name "imgdecode," was introduced to the official Node package registry on September 30, 2026, by a user account identified as "malfexteste8." According to package registry telemetry and download counters, the utility had been downloaded nearly a thousand times—specifically 979 times—prior to being flagged by security analysts. Despite public exposure, the package remained accessible on the npm platform, distributing version 1.0.3 as its latest iteration to unsuspecting developers and organizations working within Windows environments.
Security specialists at SafeDep, who analyzed the mechanics of the package, detailed how the threat actor cleverly conceals malicious behavior within a native Node.js addon. The package relies on a remarkably brief nine-line JavaScript file designed to load a Windows dynamic-link library, commonly known as a DLL. When a Node.js software application calls require('imgdecode') within a Windows console environment, the underlying DLL quietly attempts to contact GitHub to download an encrypted payload of shellcode. Once retrieved, the library decrypts this incoming response and directly injects the resulting code into a newly spawned dllhost.exe system process, effectively executing malicious operations under the guise of a legitimate Windows binary.
The MALFEX campaign itself is not entirely new to the cybersecurity community. It was first thoroughly documented and brought to light by security analysts at Checkmarx and CloudSEK, who identified it as a long-running, persistent campaign orchestrated by an unknown threat actor. Operating continuously since August 6, 2023, the campaign has consistently targeted Windows systems by flooding the npm registry with malicious packages distributed across a rotating array of publisher handles, including malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4.
Initial investigations into the MALFEX ecosystem revealed a diverse portfolio of threat mechanisms. Out of an initial batch of eight identified malicious packages, three functioned specifically as loaders for the Overlord RAT, a notorious remote access trojan. Simultaneously, a trio of other packages—namely "cdn-img-fetch," "img-to-native," and "native-runner"—worked in tandem to download and execute a sophisticated Node.js-based information stealer. A separate, third infection vector utilized automated postinstall hooks to execute rogue JavaScript capable of reaching out to external command-and-control servers to fetch unspecified subsequent binary stages.
What has particularly alarmed researchers is the remarkable agility and responsiveness demonstrated by the threat actor behind MALFEX. The operator has routinely adapted their tactics in response to public security disclosures and subsequent package removals by registry administrators. When security teams exposed packages like "native-runner" and "img-to-native," the operator swiftly published direct replacements under new names such as "runhelper" and "imgbundle" within a mere 48-hour window, culminating rapidly in the rollout of the "imgdecode" package.
A closer look at the evolution of the Node.js stealer chain reveals a deliberate effort to bypass traditional detection mechanisms. Unlike many automated supply chain attacks, none of the packages in this specific chain featured a standard install hook to trigger execution upon downloading. Instead, malicious execution is triggered explicitly when the "native-runner" module is loaded into memory. The package explicitly lists "img-to-native" as a dependency, which in turn references related modules in a recursive loop designed to obfuscate execution flow and evade naive static analysis scanners.
The auxiliary packages involved in the campaign each serve specialized operational roles within the broader attack chain. "Runhelper," which was publicly advertised as a utility helper designed to assist developers in launching native binaries from within Node.js projects, functions as a direct successor to "native-runner." Its primary operational responsibility is to locate a specific image file—disguised locally as a JPG file named cdn-img-fetch/.runtime/rt.jpg—extract embedded shellcode from it, copy that raw code directly into executable memory spaces, and execute it using Koffi, an advanced Foreign Function Interface module for Node.js.
The operational architecture shifted slightly with the introduction of "imgdecode." According to SafeDep’s technical breakdown, just six hours after "runhelper" was pulled from the registry, the operator deployed "imgdecode" to incorporate a compiled DLL directly capable of fetching and decrypting payloads. While earlier iterations of "imgdecode," specifically versions 1.0.1 and 1.0.2, still relied on calling require('imgbundle') as an intermediary step before loading the DLL, version 1.0.3 completely stripped away that dependency, rendering it a standalone tool that required no other external MALFEX packages to complete its objective.
In its earliest form, version 1.0.0 of "imgdecode" operated similarly to its predecessors, waiting passively for "imgbundle" to write a file into the cdn-img-fetch/.runtime/ directory. Once the file materialized, the package read its contents into system memory and handed them off to a native Node.js addon designed to decode the incoming data stream.
This native addon is implemented as a 64-bit Microsoft Visual C++ DLL. Upon initialization, the DLL performs environmental checks to confirm whether it is executing inside a developer’s terminal. Once verified, it proceeds to fetch an ostensibly innocuous image file named banner.jpg from a specific GitHub repository under the account "cavecrew/proj." It then decrypts the hidden payload embedded within the image using a hardcoded decryption key, "nif-runtime-2027," before injecting the final plaintext output directly into the dllhost.exe process.
Security analysts noted a distinct failsafe or anti-analysis mechanism built into the DLL’s decryption routine. After performing the decryption process, the DLL evaluates the initial bytes of the resulting plaintext. If those bytes match standard JPEG or PNG file signatures, the DLL halts execution entirely. Researchers infer from this behavior that the threat actor could dynamically neutralize active loaders across compromised systems simply by serving encrypted content that decrypts back into a standard, non-malicious image file. Conversely, serving an ordinary, unencrypted image would cause the decryption logic to fail this signature check before reaching the malicious injection phase.
Although the GitHub repository and associated account managed under the handle "cavecrew" have since been taken offline and rendered inaccessible, historical snapshots captured by the Internet Archive offer valuable forensic context. A screenshot dated October 6, 2026, confirms that the repository hosted the exact Go-based downloader utilized to fetch both the Node.js information stealer and a remote access tool known as "movinlike" from an external infrastructure IP address. Furthermore, analysis of the accompanying Node.js application revealed a .env configuration file containing a hardcoded command-and-control server address alongside a MALFEX license key, pointing strongly toward the commercial or automated use of a malware builder framework.
Once the payload successfully executes on a target machine, it initiates an aggressive suite of anti-analysis and reconnaissance procedures. The malware actively audits the local environment for indicators of virtual machines, sandboxes, and common administrative or security analysis utilities such as Process Monitor and Wireshark. After verifying that it is running on a genuine, unprotected developer workstation, it begins harvesting sensitive files matching specific criteria, including seed phrases, cryptocurrency wallet data, and files possessing extensions like .kdbx, .pem, .ppk, and .env. It also targets stored credentials and session data from Chromium-based web browsers, Discord, Telegram, popular gaming platforms including Steam, Epic Games, Riot, Battle.net, Minecraft, and Ubisoft.
Beyond simple credential harvesting, the malware establishes an active WebSocket connection back to the command-and-control infrastructure, granting the remote operator comprehensive post-compromise capabilities. Through this channel, the threat actor can issue commands for arbitrary shell execution, file transfers, process control, clipboard monitoring, screen capturing, and remote mouse and keyboard manipulation. To ensure persistence across system reboots, the malware inserts a Run key into the Windows Registry and registers a malicious scheduled task masquerading as a legitimate update utility under the name "MicrosoftEdgeUpdateService."
Given the sophisticated and invasive nature of the MALFEX campaign, cybersecurity professionals strongly advise any software developers or organizations who may have inadvertently installed "imgdecode" or its related ecosystem packages to treat their Windows environments as fully compromised. Affected systems should be immediately isolated from corporate networks, thoroughly audited for unauthorized persistence mechanisms, and subjected to comprehensive credential rotation. Furthermore, developers who stored cryptocurrency seed phrases or private keys on impacted machines are strongly urged to transfer remaining funds to secure, uncompromised wallets immediately.
