Cybersecurity researchers have uncovered a newly published malicious npm package actively targeting Windows operating systems, serving as the latest vector in a persistent software supply chain attack campaign designated under the codename MALFEX.
The offending package, identified by the name "imgdecode," was uploaded to the public JavaScript package registry on September 30, 2026, by a user account operating under the handle "malfexteste8." Despite ongoing security monitoring and automated vulnerability alerts within the open-source ecosystem, the package managed to accumulate 979 downloads as of the time of reporting and remained accessible on the npm registry. According to package tracking metadata, the most recent version of the module is 1.0.3, representing an iterative refinement of the attacker’s deployment methodology.
Detailed technical analysis conducted by cloud security and dependency management firm SafeDep revealed that the "imgdecode" package conceals a sophisticated malicious loader inside a compiled Node.js native addon. At first glance, the package appears innocuous, relying on a brief nine-line JavaScript file designed to load a Windows dynamic-link library. However, when a Node.js application initiates a require call to "imgdecode" from within a Windows console environment, the underlying dynamic-link library activates. It immediately attempts to contact an external GitHub repository to download a heavily encrypted payload of shellcode. Once downloaded, the library decrypts the response in memory and executes a process injection technique to inject the resulting payload directly into a new instance of the legitimate Windows system process, dllhost.exe.
The discovery of "imgdecode" adds another chapter to the MALFEX campaign, an extensive and evolving software supply chain threat first documented by security researchers at Checkmarx and CloudSEK. MALFEX refers to a long-running, coordinated operation in which an unidentified threat actor has systematically published malicious packages to the npm registry since August 6, 2023. The overarching objective of this campaign has consistently been the remote compromise of Windows-based developer workstations and enterprise servers. Throughout the campaign, malicious payloads have been distributed across a rotating array of publisher handles, including malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4, before expanding to newer accounts like the one responsible for "imgdecode."
Previous analysis of the campaign catalogued a series of related packages with varied functional capabilities. Among the initial eight identified packages, three were engineered to act as straightforward loaders for the Overlord Remote Access Trojan (RAT), while a trio of packages bearing the names "cdn-img-fetch," "img-to-native," and "native-runner" operated in tandem to download and execute a modular Node.js-based information stealer. An alternative infection pathway deployed across the campaign relied on custom postinstall hooks designed to execute arbitrary JavaScript upon installation. This script would subsequently contact an external command-and-control server to fetch an unspecified next-stage binary, ensuring persistent and adaptable execution across compromised machines.
Intelligence gathered from threat intelligence feeds indicates that the threat actor behind MALFEX closely monitors public security disclosures and registry removal actions. Rather than abandoning their infrastructure when packages are flagged and taken down, the operators demonstrate a high degree of agility. For instance, when security teams forced the removal of the "native-runner" and "img-to-native" packages, the operator published functional replacements named "runhelper" and "imgbundle" within a mere two-day window. The rollout of "imgdecode" followed this exact reactive playbook, reflecting a continuous cycle of evasion and re-tooling.
The infection mechanism utilized by the Node.js stealer chain exhibits notable technical traits, particularly the deliberate avoidance of standard installation hooks. Instead of executing malicious code immediately during the package installation phase, the threat relies on runtime execution triggered when the primary module is loaded into memory. For example, the "native-runner" package lists "img-to-native" as a direct dependency, which in turn references related modules in a chained dependency tree designed to obfuscate the execution flow.
Further examination of the specific utilities deployed in these chains highlights the attackers’ reliance on native integration tools. The package "Runhelper," which was publicly advertised on the registry as a benign helper utility intended to assist developers in launching native binaries from within Node.js projects, shares functional similarities with "native-runner." Its primary operational responsibility is to locate a specific JPEG image file stored locally under the path "cdn-img-fetch/.runtime/rt.jpg," extract embedded shellcode from the image data, copy that code into executable memory space, and execute it using Koffi, an advanced Foreign Function Interface module for Node.js that enables interaction with native libraries.
As security teams forced the unpublication of "runhelper," the threat actor pivoted rapidly, publishing "imgdecode" equipped with a compiled dynamic-link library designed to handle shellcode execution independently. According to SafeDep’s analysis, starting from version 1.0.1, the dynamic-link library assumed the responsibility of downloading and decrypting the payload directly. While initial iterations of "imgdecode"—specifically versions 1.0.1 and 1.0.2—maintained a dependency that required calling "imgbundle" before the dynamic-link library could load, the subsequent version 1.0.3 removed this external dependency entirely, allowing the package to function as a self-contained MALFEX vector.
Similarly, version 1.0.0 of "imgdecode" was designed to wait for "imgbundle" to write a file to the local directory structure at "cdn-img-fetch/.runtime/." Once the data file became available, the package read its contents into memory and passed the raw byte stream to a native Node.js addon responsible for decoding the information.
The underlying addon itself is a 64-bit Microsoft Visual C++ dynamic-link library. Upon execution, it performs environmental checks to verify whether it is running within a developer’s terminal. If the conditions are met, the library fetches a seemingly ordinary JPEG file named "banner.jpg" from a designated repository hosted on GitHub under the user path "cavecrew/proj." It then decrypts the hidden payload embedded within the image file using a hardcoded cryptographic key string, "nif-runtime-2027," before injecting the resulting binary output into the system process dllhost.exe.
Security analysts noted sophisticated logic built into the decryption routine. After processing the data, the dynamic-link library inspects the leading bytes of the resulting plaintext. If the signature matches standard JPEG or PNG file headers, the library halts execution. Security researchers infer from this behavior that the campaign operator possesses a remote kill-switch or quality-assurance mechanism, enabling them to disable active loaders simply by serving encrypted content that decrypts back into a benign image file. Conversely, serving an ordinary, unencrypted image would typically cause the decryption algorithm to fail prior to reaching this validation check.
Although the GitHub account operating under the alias "cavecrew" has since been taken down and rendered inaccessible, historical records captured via Internet Archive screenshots from early October 2026 reveal that the repository hosted the exact Go-based downloader infrastructure utilized to retrieve the secondary Node.js information stealer and the "movinlike" remote access tool from an external IP address.
Further inspection of the recovered Node.js application files revealed an embedded environment configuration file containing a hardcoded command-and-control server address alongside a MALFEX-specific software license key. This artifact strongly suggests that the threat actor is leveraging a centralized malware builder framework or commercial-style licensing infrastructure to generate customized payloads for individual deployment campaigns.
Once successfully established on a target system, the malware initiates a comprehensive suite of anti-analysis procedures. It audits the host environment for indicators of virtualization, sandbox execution, and common administrative or security monitoring software, such as Process Monitor and Wireshark. Upon verifying that it is operating on a genuine developer workstation, the malware begins harvesting sensitive data. It targets files matching specific file extensions and seed phrases, including cryptographic key files, private keys, wallet configurations, and environment files. Furthermore, it extracts stored credentials, session tokens, and application data from Chromium-based web browsers, Discord, Telegram, cryptocurrency wallets, and a wide array of popular gaming platforms.
To maintain operational reach, the payload establishes an outbound WebSocket connection back to the command-and-control infrastructure. This persistent channel grants the remote operator the ability to issue dynamic commands for executing shell scripts, transferring files, controlling active processes, capturing clipboard contents, taking screenshots, and simulating mouse and keyboard input. For long-term system persistence across reboots, the malware inserts a Run key into the Windows Registry and configures a malicious scheduled task designed to blend in with legitimate system operations under the deceptive label "MicrosoftEdgeUpdateService."
Given the invasive nature of these payloads and the extensive system access they achieve, cybersecurity professionals strongly advise any development teams or organizations that have inadvertently installed the affected packages to treat their Windows environments as fully compromised. Immediate remediation steps include isolating affected machines from the corporate network, inspecting system persistence mechanisms for unauthorized registry entries and scheduled tasks, rotating all compromised credentials and API keys, and immediately securing cryptocurrency assets by transferring funds to newly generated, uncompromised wallets in the event that seed phrases or private keys were stored locally.
