Cybersecurity researchers have uncovered a new malicious npm package distributed as part of a persistent and evolving software supply chain attack campaign tracked under the designation MALFEX. The package, identified as "imgdecode," was uploaded to the public JavaScript package registry on September 30, 2026, by a user account operating under the handle "malfexteste8." Despite ongoing security monitoring and swift disclosures by the threat intelligence community, the package managed to record nearly a thousand downloads before continuing to remain accessible on the npm platform in its latest version, 1.0.3.
According to a technical analysis published by security firm SafeDep, the "imgdecode" package conceals a sophisticated malicious loader embedded directly within a compiled Node.js native addon. The package relies on an extremely concise nine-line JavaScript file designed to invoke a Windows dynamic-link library, commonly referred to as a DLL. When a targeted Node.js software application executes the require('imgdecode') command within a Microsoft Windows console environment, the underlying DLL immediately triggers an outbound network request to GitHub. Its objective is to fetch an encrypted payload disguised as shellcode, decrypt the incoming response using a hardcoded cryptographic key, and inject the resulting execution flow directly into a legitimate system process, specifically dllhost.exe.
The broader MALFEX campaign was initially brought to light by security researchers at Checkmarx and CloudSEK. It represents a long-running, calculated operation in which an unidentified threat actor has systematically published malicious software packages to the npm registry since August 6, 2023. The primary objective of this threat campaign is the comprehensive compromise of Windows operating systems. Over the course of the campaign, the threat actors have distributed malicious code across multiple publisher handles, including malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4.
Prior analysis of the campaign identified eight distinct packages associated with the operation. Among them, three packages were engineered to function as loaders for the Overlord Remote Access Trojan, while three others—named "cdn-img-fetch," "img-to-native," and "native-runner"—collaborated closely to download and execute a specialized Node.js information stealer. An alternative infection vector deployed within the campaign utilized postinstall execution hooks designed to contact an external command-and-control server and retrieve subsequent malicious binaries.
Investigative timelines reveal that the threat actor behind MALFEX actively adapts to public scrutiny, security disclosures, and subsequent package removals by the npm security team. When security researchers flagged and removed packages like "native-runner" and "img-to-native," the operator rapidly published functional replacements under the names "runhelper" and "imgbundle" within a span of just two days. On that exact same day, the very first version of "imgdecode" was deployed to the registry, demonstrating the resilience and continuous iteration capability of the threat actor.
Unlike traditional supply chain attacks that rely on automated installation scripts, the Node.js stealer component of the MALFEX campaign is notable for its deliberate omission of install hooks. Instead, the malicious behavior is triggered dynamically when the "native-runner" package is explicitly loaded by an application. The package maps "img-to-native" as a direct dependency, which in turn establishes circular dependency references to obscure its operational logic and evade automated static analysis tools.
Further examination of the ecosystem reveals specific operational roles for each component package involved in the attack chain. The package known as "runhelper," which was publicly advertised on the registry as a utility helper designed to facilitate the execution of native binaries from within Node.js projects, shares close architectural similarities with "native-runner." Its primary functional responsibility is to locate a specific JPEG image file stored locally under the path cdn-img-fetch/.runtime/rt.jpg, extract raw shellcode embedded within the image data, copy it directly into executable system memory, and execute it using Koffi, a Foreign Function Interface module for Node.js.
Security researchers at SafeDep noted that approximately six hours after the "runhelper" package was unpublished from the registry, the operator deployed "imgdecode" equipped with a compiled native DLL designed to handle shellcode execution independently. Starting with version 1.0.1, the DLL assumed full responsibility for downloading and decrypting the primary payload. While initial versions 1.0.1 and 1.0.2 continued to rely on a require('imgbundle') call prior to loading the DLL, version 1.0.3 completely stripped away that external dependency, allowing the package to operate entirely standalone without requiring any other MALFEX-associated packages.
In a manner similar to "runhelper," version 1.0.0 of "imgdecode" functions by waiting for the "imgbundle" package to deposit a file into the cdn-img-fetch/.runtime/ directory. Once the target file becomes available, the package reads its contents into memory and passes the raw data to a native Node.js addon intended for decoding purposes. This addon is implemented as a 64-bit Microsoft Visual C++ DLL. Upon execution, it performs initial environmental checks to verify whether it is operating within a legitimate developer terminal or an isolated debugging environment. If these checks pass, it proceeds to fetch a file named banner.jpg from a specific GitHub repository under the account path cavecrew/proj. It then decrypts the embedded payload utilizing the hardcoded cryptographic key nif-runtime-2027 and injects the resulting code directly into the dllhost.exe process.
Security analysts have pointed out an intriguing operational mechanism built into the DLL’s decryption routine. After decrypting the payload, the DLL inspects the leading bytes of the resulting plaintext data. If the header matches standard JPEG or PNG file signatures, the DLL halts execution. Threat intelligence inferences suggest that this feature allows the threat actor to remotely disable the loader functionality at will by serving encrypted content that decrypts cleanly into a benign image file. Conversely, serving a standard, unencrypted image file would typically cause the decryption routine to fail prior to reaching this validation check.
Although the GitHub user account associated with the repository, "cavecrew," has since been rendered inaccessible, archival snapshots of the image file dating back to early October 2026 confirm that it hosted the same Go-based downloader mechanism previously utilized to retrieve the Node.js stealer and a remote access tool known as "movinlike" from an external infrastructure IP address. Furthermore, the underlying Node.js application contained a configuration environment file embedding a command-and-control server address alongside a MALFEX license key. This discovery strongly suggests the utilization of commercial-style malware builders or structured licensing frameworks by the threat actors to generate and deploy these customized payloads.
The deployed malware incorporates extensive anti-analysis routines designed to audit the host environment for the presence of virtual machines, sandboxes, and common security analysis utilities such as Process Monitor and Wireshark. Once it verifies that it is operating on a genuine victim machine, it begins harvesting sensitive files matching specific file extensions and seed phrases, including .kdbx password manager databases, private cryptographic keys with .pem and .ppk extensions, and environment configuration files. Additionally, it systematically targets stored data from Chromium-based web browsers, Discord, Telegram, cryptocurrency software wallets, and popular gaming applications such as Steam, Epic Games, Riot Games, Battle.net, Minecraft, and Ubisoft.
Beyond data exfiltration, the malware establishes persistent outbound WebSocket connections back to the command-and-control infrastructure. This persistent channel grants the remote operator the ability to issue arbitrary shell execution commands, transfer files, control active processes, capture clipboard contents, take screenshots, and simulate mouse and keyboard input. To ensure operational persistence across system reboots, the malware creates a Registry Run key and registers a scheduled task disguised under the benign name "MicrosoftEdgeUpdateService."
Security experts strongly advise software developers and organizations who may have inadvertently installed any of the identified malicious packages to treat their Windows systems as entirely compromised. Recommended incident response measures include isolating affected machines from the corporate network, inspecting system registries and task schedulers for persistence artifacts, immediately rotating credentials and API keys, and securing digital assets and cryptocurrency wallets by transferring funds to newly generated, uncompromised addresses.
