MALFEX imgdecode npm package embeds Windows shellcode loader
Security researchers have identified imgdecode, a malicious npm package linked to the MALFEX supply-chain campaign. Uploaded on September 30, 2026 by the account malfexteste8, the package had recorded 979 downloads and remained available on npm at the time of reporting. Its latest listed release is version 1.0.3.
SafeDep said the package conceals a loader inside a compiled Node.js addon. Its JavaScript component is only nine lines long, but loading require('imgdecode') from a Windows console causes it to invoke a DLL. That DLL attempts to retrieve encrypted shellcode from GitHub, decrypt it and inject it into a newly created dllhost.exe process.
A replacement package after npm removals
MALFEX was documented by Checkmarx and CloudSEK as a campaign in which an unidentified actor has published malicious npm packages targeting Windows systems since August 6, 2023. Researchers associated eight packages with five publisher handles: malfexkkj, malfex_user, malfexteste2, malfexteste3 and malfexteste4.
The operator appears to have adapted rapidly to package removals. npm removed native-runner and img-to-native on September 28, 2026. On September 30, the actor published imgbundle as a replacement for img-to-native and runhelper as a replacement for native-runner. After runhelper was unpublished, imgdecode 1.0.0 appeared six hours later.
Version 1.0.0 waited for imgbundle to create a file under cdn-img-fetch/.runtime/, then passed its contents to the native addon. From version 1.0.1, the DLL itself also downloaded and decrypted the payload. Versions 1.0.1 and 1.0.2 still invoked imgbundle before loading the DLL, whereas version 1.0.3 removed that dependency and requires no other MALFEX package.
Image files used to carry the payload
The 64-bit Microsoft Visual C++ DLL checks whether it is running in a developer terminal, then fetches banner.jpg from the GitHub repository cavecrew/proj. It decrypts the embedded content using the key nif-runtime-2027 and injects the resulting payload into dllhost.exe.
SafeDep reported that, after decryption, the DLL examines the plaintext header and stops if it finds a JPEG or PNG signature. This creates a mechanism by which the payload delivery can be disabled by serving encrypted content that decrypts to an image.
An Internet Archive capture of the image dated October 6 showed the same Go-based downloader used to retrieve a Node.js stealer and the movinlike remote-access tool from 104.234.65[.]75:700. The application contained a .env file with a command-and-control address at 104.234.65[.]75:7007 and a MALFEX license key.
What affected development teams should do
The malware checks for virtual machines, sandboxes, Process Monitor and Wireshark before collecting files matching seed phrases and extensions including .kdbx, .pem, .ppk and .env. It also targets Chromium-based browser data, Discord, Telegram, cryptocurrency wallets and several gaming applications. Its remote commands can support shell execution, file transfer, screenshots, clipboard access and mouse or keyboard input.
Persistence is established through a Registry Run key and a scheduled task named MicrosoftEdgeUpdateService. Businesses that installed any named MALFEX package should isolate affected Windows systems, inspect those persistence locations, rotate credentials and transfer cryptocurrency funds to new wallets when seed phrases may have been stored on the device.