Cybersecurity researchers have discovered a malicious npm package named imgdecode that is part of an ongoing software supply chain attack campaign known as MALFEX. The package was found hiding a malicious loader inside a compiled Node.js native addon designed to target Windows systems. According to security firm SafeDep, the package was uploaded to the npm registry on September 30, 2026, by a user named “malfexteste8” and had been downloaded 979 times at the time of disclosure. The latest available version identified by researchers was imgdecode 1.0.3. The discovery highlights continued risks within open source package ecosystems, where developers may unknowingly introduce malicious components into applications through trusted package repositories.
SafeDep researchers explained that imgdecode contains a small JavaScript component that loads a Windows dynamic link library (DLL) when the package is called from a Node.js application. The DLL attempts to retrieve encrypted shellcode from a GitHub repository, decrypts the payload, and injects the resulting code into a new dllhost.exe process. Unlike traditional malware delivery methods that rely on installation scripts, the malicious activity in this campaign is triggered when the package functionality is executed. Researchers said MALFEX has been active since August 2023 and involves an unknown threat actor publishing malicious npm packages under multiple publisher accounts, including malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4. Earlier analysis from Checkmarx and CloudSEK identified multiple packages connected to the campaign, with some acting as loaders for Overlord RAT while others were used to download and execute a Node.js based information stealer.
Researchers observed that the threat actor adjusted its activity following public disclosures and npm package removals by publishing replacement packages. After npm removed packages including native-runner and img-to-native, replacement packages such as runhelper and imgbundle appeared shortly afterward. The imgdecode package was published on the same day as these replacements and later received multiple updates. According to SafeDep, earlier versions of imgdecode depended on another MALFEX package before later versions removed that dependency and operated independently. The package uses a compiled Microsoft Visual C++ DLL that checks whether it is running in a developer environment before downloading an encrypted JPG file from a GitHub repository. The embedded payload is decrypted using a specific key and processed before being injected into dllhost.exe. Researchers noted that the loader includes conditions that can prevent execution depending on the decrypted content, allowing the operator to potentially disable the payload by serving specific files.
The wider MALFEX campaign involves multiple infection methods designed to compromise Windows systems. Researchers found that related packages such as cdn-img-fetch, img-to-native, and native-runner worked together to download encrypted content, decrypt payloads, and execute additional malware. The campaign has also been linked to a Node.js stealer capable of collecting sensitive information from Chromium based browsers, Discord, Telegram, cryptocurrency wallets, gaming applications, and files containing specific extensions such as .kdbx, .pem, .ppk, and .env. The malware performs anti-analysis checks against virtual machines, sandboxes, and security tools before continuing execution. It can establish communication with command and control infrastructure through WebSocket connections, allowing operators to execute commands, transfer files, control processes, capture screenshots, and access clipboard information. Researchers also found persistence mechanisms involving Registry Run keys and scheduled tasks.
Security researchers advised developers who installed affected MALFEX packages to treat their Windows systems as potentially compromised. Recommended actions include isolating affected devices, checking for persistence mechanisms, rotating credentials, and reviewing sensitive information that may have been exposed. Developers who stored cryptocurrency recovery phrases or other confidential data on affected systems have also been advised to take additional protective measures. The discovery reinforces the importance of reviewing open source dependencies, monitoring package activity, and applying security controls when using third party libraries in software development environments.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
