MALFEX Campaign Escalates: New Malicious ‘imgdecode’ Package Discovered Targeting Windows Systems via npm Registry

The landscape of software supply chain security has faced a persistent and evolving threat as cybersecurity researchers uncover a sophisticated malware campaign dubbed "MALFEX." This campaign, which has been active for over three years, recently reached a new milestone with the discovery of a malicious npm package named "imgdecode." This latest finding highlights the agility of threat actors who continue to exploit the trust inherent in open-source ecosystems to compromise Windows-based development environments and production systems.

The package in question, "imgdecode," was first identified by security researchers at SafeDep after it was uploaded to the npm registry on September 30, 2026. Attributed to a user account operating under the handle "malfexteste8," the package managed to garner nearly 1,000 downloads—979 at the time of the latest analysis—before its true nature was fully understood by the security community. Despite the identification of its malicious components, the package remained accessible on the registry for a period, highlighting the challenges faced by repository maintainers in policing millions of active packages.

At first glance, "imgdecode" appears to be a legitimate utility for image processing. However, a deep dive into its source code reveals a highly specialized loader designed to bypass traditional security scanners. Unlike many crude malicious packages that rely on obvious post-installation scripts, "imgdecode" utilizes a compiled Node.js native addon to execute its payload. This method is particularly effective because native addons, which are often written in C or C++, are typically distributed as binary files, making them significantly harder for static analysis tools to inspect compared to standard JavaScript files.

The Anatomy of the Attack

The technical execution of "imgdecode" is a masterclass in minimalist evasion. The package contains a deceptively simple nine-line JavaScript file. When a developer or a Node.js application invokes the command require('imgdecode') on a Windows system, the JavaScript code triggers the loading of a Windows dynamic-link library (DLL). This DLL is the core of the infection mechanism.

Once active within a Windows console environment, the DLL initiates a network request to a GitHub repository to fetch what appears to be an ordinary image file. In reality, this file contains encrypted shellcode. The loader is programmed to decrypt this response in memory and subsequently inject the resulting malicious code into a new "dllhost.exe" process. By choosing "dllhost.exe"—a legitimate Windows system process—the malware effectively masks its presence, blending into the background of standard system operations to avoid detection by basic task monitoring tools.

This discovery is part of a much larger narrative. MALFEX was first documented in detail by security firms Checkmarx and CloudSEK, who identified it as a long-running campaign. The threat actor behind MALFEX has been systematically publishing malicious packages to npm since at least August 6, 2023. These packages have been distributed through a series of interconnected publisher handles, including "malfexkkj," "malfex_user," "malfexteste2," "malfexteste3," and "malfexteste4." The consistent naming convention suggests a single operator or a tightly coordinated group that is undeterred by previous package removals.

Evolution and Adaptability

One of the most concerning aspects of the MALFEX campaign is the speed at which the threat actor adapts to public disclosures. Researchers noted that as soon as security reports were published and packages like "native-runner" or "img-to-native" were removed from the npm registry, the operator responded within 48 hours by publishing functional replacements.

For instance, when the "native-runner" package was flagged, the actor introduced "runhelper" and "imgbundle." On the same day these replacements appeared, the first version of "imgdecode" was also released. This rapid-response cycle indicates a dedicated adversary who is actively monitoring the security industry’s reaction to their work.

The campaign utilizes several distinct infection pathways. Of the eight primary packages identified by researchers, three functioned as loaders for the Overlord Remote Access Trojan (RAT). Three others, including "cdn-img-fetch" and "img-to-native," worked in tandem to download and execute a Node.js-based credential stealer. A third, more traditional pathway involved the use of post-install hooks—scripts that run automatically when a package is installed—to contact external servers and retrieve next-stage binaries.

The "imgdecode" package represents a further refinement of these tactics. In its latest iteration, version 1.0.3, the package has become entirely self-contained. Earlier versions (1.0.1 and 1.0.2) required the presence of another MALFEX package, "imgbundle," to function. However, the developer eventually removed this dependency, allowing "imgdecode" to operate as a standalone threat, thereby reducing the "noise" created by multiple package installations and making the attack harder to track.

Advanced Evasion and Anti-Analysis

The MALFEX operator has integrated several sophisticated anti-analysis techniques into their binaries. The DLL used in the "imgdecode" chain includes a check to determine if it is running within a developer’s terminal or a controlled analysis environment. If it detects the presence of virtual machines, sandboxes, or common security tools such as Process Monitor and Wireshark, it may alter its behavior or cease execution entirely to avoid being caught by researchers.

Furthermore, the malware employs a clever "kill switch" mechanism. After decrypting the payload fetched from GitHub, the DLL checks the first few bytes of the plaintext. If these bytes match the file signature of a legitimate JPEG or PNG image, the DLL terminates its operation. This suggests that the operator can effectively "turn off" the infection chain remotely by simply replacing the malicious encrypted file on GitHub with a standard image file. If the decryption yields a valid image instead of shellcode, the loader assumes the campaign is paused or completed and stops the injection process.

Impact and Payload Capabilities

The ultimate goal of the MALFEX campaign appears to be comprehensive data theft and system control. The Node.js stealer deployed in these attacks is particularly aggressive. It is designed to harvest a wide array of sensitive information, including:

• Cryptocurrency Assets: The malware searches for seed phrases and wallet data, specifically targeting files with extensions like .kdbx, .pem, and .ppk.
• Browser Data: It extracts saved passwords, cookies, and autofill information from Chromium-based web browsers.
• Communication Platforms: Data is harvested from Discord and Telegram accounts.
• Gaming Accounts: The stealer targets credentials and session data from platforms including Steam, Epic Games, Riot Games, Battle.net, Minecraft, and Ubisoft.
• Development Environments: It scans for .env files, which often contain sensitive API keys, database credentials, and other secrets used in software development.

Beyond simple data theft, the malware establishes a WebSocket connection to a command-and-control (C2) server, identified in recent samples as "104.234.65[.]75." Through this connection, the attacker can issue real-time commands to the compromised system. These capabilities include executing shell commands, transferring files, controlling active processes, accessing the clipboard, taking screenshots, and even monitoring or hijacking mouse and keyboard input.

To ensure long-term access, the malware implements persistence by adding a Registry Run key and creating a scheduled task deceptively named "MicrosoftEdgeUpdateService." This ensures that the malicious code is re-executed every time the system boots or at specific intervals, even if the initial process is terminated.

The presence of a .env file within the malicious Node.js application containing a "MALFEX license key" is a particularly telling detail. It suggests that the threat actor may be using a specialized malware builder or that the MALFEX toolset is being operated as a service, potentially sold or licensed to other cybercriminals.

Recommendations for Developers

The discovery of "imgdecode" serves as a stark reminder of the vulnerabilities within the modern development workflow. Security experts advise any developer who has interacted with the aforementioned packages to take immediate action.

Because the malware is designed for persistence and deep system integration, a standard uninstallation of the npm package is insufficient. Affected systems should be treated as fully compromised. Recommended steps include isolating the machine from the network, auditing the Windows Registry and Task Scheduler for unauthorized entries, and performing a clean re-installation of the operating system if possible.

Furthermore, because the MALFEX stealer specifically targets credentials and cryptocurrency wallets, users must rotate all passwords and API keys that were stored on the affected machine. If cryptocurrency seed phrases were accessible to the system, funds should be moved to new, secure wallets immediately.

As the MALFEX campaign continues to evolve, the security community remains on high alert. The transition from simple script-based attacks to sophisticated, native-binary loaders represents a significant escalation in the ongoing battle to secure the global software supply chain. Developers are urged to exercise extreme caution when adding new dependencies to their projects and to utilize tools that can provide deeper visibility into the behavior of third-party packages.