Cybersecurity researchers have uncovered a malicious npm package disguised as a utility tool, marking the latest escalation in a persistent software supply chain attack campaign tracked under the codename MALFEX. The package, identified as "imgdecode," was uploaded to the public JavaScript package registry and has already been downloaded hundreds of times by unsuspecting developers.
The discovery highlights the ongoing risks associated with open-source package registries, where threat actors continually adapt their tactics to bypass security controls, evade initial detection, and compromise Windows environments. According to telemetry and analysis from cybersecurity firms, the campaign relies on sophisticated multi-stage infection pathways, utilizing native Node.js addons, encrypted payloads, and dynamic shellcode injection techniques to deploy information stealers and remote access trojans.
The Anatomy of the "imgdecode" Package
The malicious package, named "imgdecode," was published to the npm registry on September 30, 2026, by a user account operating under the handle "malfexteste8." By the time researchers flagged the activity, the package had accumulated nearly a thousand downloads while remaining actively available on the platform in its latest 1.0.3 iteration.
Security analysis conducted by SafeDep revealed that "imgdecode" conceals a malicious loader inside a compiled Node.js native addon. At its core, the package relies on a brief nine-line JavaScript file designed to invoke a Windows dynamic-link library (DLL). When a Node.js application triggers a require('imgdecode') command within a Windows console environment, the underlying DLL initiates an outbound network request to fetch an encrypted payload hosted on GitHub. Once retrieved, the DLL decrypts the response and injects the resulting code directly into a newly spawned dllhost.exe process.
Initial versions of the package functioned interdependently with other components of the MALFEX ecosystem. For instance, versions 1.0.1 and 1.0.2 were configured to require an auxiliary package named "imgbundle" before executing the DLL loader. However, version 1.0.3 streamlined the attack vector by removing external dependencies entirely, allowing the package to operate as a standalone entry point for the underlying malware.
Evolution of the Long-Running MALFEX Campaign
The broader MALFEX campaign was first documented by security researchers at Checkmarx and CloudSEK, who identified a coordinated, long-running operation launched by an unknown threat actor. Dating back to August 2023, the campaign has consistently targeted Windows systems by publishing malicious packages across multiple publisher handles, including malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4, and more recently, malfexteste8.
Security teams have identified multiple infection pathways associated with the campaign. Several early packages were found to act as loaders for the Overlord RAT, while others—such as "cdn-img-fetch," "img-to-native," and "native-runner"—collaborated to download and execute a dedicated Node.js information stealer. Alternative pathways involved postinstall hooks capable of retrieving and executing subsequent secondary binaries from external infrastructure.
The threat actor has demonstrated a high degree of adaptability, rapidly replacing packages removed by platform administrators. Following the public disclosure and subsequent removal of utilities like "native-runner" and "img-to-native," the operator published alternative tools such as "runhelper" and "imgbundle" within a matter of days, quickly followed by the introduction of "imgdecode."
Operational Mechanics and Payload Delivery
The Node.js stealer chain employed in the campaign is notable for its lack of traditional install hooks. Instead of executing code immediately upon installation, the malicious behavior is triggered dynamically when specific packages are loaded into memory. For example, "runhelper"—marketed as a helper utility for launching native binaries from Node.js projects—functions by locating a specific JPEG file (cdn-img-fetch/.runtime/rt.jpg), extracting embedded shellcode, allocating it into executable memory, and executing it using Koffi, a Foreign Function Interface (FFI) module for Node.js.
The "imgdecode" package follows a similarly intricate execution flow. The 64-bit Microsoft Visual C++ DLL embedded within the package performs preliminary environment checks to determine whether it is executing inside a developer’s terminal. Upon passing these environmental validations, the DLL retrieves a cover image file named banner.jpg from a dedicated repository. It then decrypts the embedded payload using a hardcoded key, "nif-runtime-2027," and injects the resulting code into the dllhost.exe process.
To evade detection and maintain operational security, the decryption routine incorporates integrity checks. If the decrypted plaintext matches standard JPEG or PNG file signatures, the execution halts. This mechanism suggests that the operator can remotely neutralize the loader by serving benign image content, while the delivery of actual malicious payloads triggers the expected injection sequence.
Capabilities and Impact of the Deployed Malware
Once successfully executed on a victim’s machine, the underlying payload performs extensive reconnaissance and data harvesting. Before collecting sensitive information, the malware executes anti-analysis procedures to detect virtual machines, sandboxes, and administrative tools such as Process Monitor and Wireshark.
The stealer targets a wide array of sensitive data, specifically scanning for files matching common seed phrases and sensitive extensions, including .kdbx, .pem, .ppk, and .env. In addition to file harvesting, the malware extracts stored credentials, session tokens, and data from Chromium-based web browsers, Discord, Telegram, cryptocurrency wallets, and popular gaming platforms such as Steam, Epic Games, Riot Games, Battle.net, Minecraft, and Ubisoft.
Furthermore, the malware establishes an active WebSocket connection with a command-and-control server, enabling the threat actor to issue remote directives. These capabilities include shell execution, file transfers, process control, clipboard monitoring, screen capturing, and remote input handling via keyboard and mouse commands. For persistence, the malware modifies the Windows Registry by adding a Run key and establishes a scheduled task disguised as the "MicrosoftEdgeUpdateService."
Security professionals strongly advise developers who have interacted with any of the identified malicious packages to treat their systems as compromised. Recommended remediation steps include isolating affected Windows hosts, auditing the environment for persistence mechanisms, rotating compromised credentials, and transferring digital assets to secure wallets if sensitive recovery seed phrases were stored on the impacted machine.
