MALFEX Campaign Persists as Researchers Uncover Malicious Native Loader in Popular npm Registry

The adaptability of the MALFEX operator is perhaps the most concerning aspect of the campaign. Security analysts observed that the threat actor appears to closely monitor public disclosures and registry removals. Within just two days of "native-runner" and "img-to-native" being taken down, the operator published "runhelper" and "imgbundle" as functional replacements. On that same day, the first version of "imgdecode" was released, showing a clear intent to iterate on the delivery method to stay ahead of defenders.

The technical mechanics of the "runhelper" package provided a blueprint for the current "imgdecode" iteration. Marketed as a utility for launching native binaries within Node.js projects, "runhelper" was designed to locate a specific JPG file located at "cdn-img-fetch/.runtime/rt.jpg." This image file was not a standard graphic but a container for hidden shellcode. Using the Koffi module, a Foreign Function Interface (FFI) for Node.js, the package would extract the shellcode, copy it into executable memory, and run it. SafeDep noted that "imgdecode" was published a mere six hours after "runhelper" was unpublished, representing a direct evolution of this technique.

Starting with version 1.0.1 of "imgdecode," the attacker integrated the download and decryption logic directly into the compiled DLL. While early versions still relied on a secondary package called "imgbundle" to facilitate the attack, version 1.0.3 removed this dependency entirely, allowing "imgdecode" to function as a standalone threat. This transition to a self-contained native addon makes the package much harder for standard npm security tools to analyze, as the malicious logic is locked away in binary format rather than readable JavaScript.

The specific addon used in "imgdecode" is a 64-bit Microsoft Visual C++ (MSVC) DLL. Upon execution, the DLL performs a series of environment checks to determine if it is running in a developer’s terminal. If the conditions are met, it proceeds to fetch a file named "banner.jpg" from a GitHub repository owned by a user named "cavecrew." The DLL then decrypts the payload embedded within the image using the hardcoded key "nif-runtime-2027." Interestingly, the malware includes a check to see if the decrypted plaintext matches a standard JPEG or PNG signature. If the resulting data appears to be a legitimate image, the DLL halts execution. Researchers believe this is a "kill-switch" mechanism, allowing the operator to deactivate the loader by simply replacing the encrypted payload on GitHub with a standard image file.

Although the "cavecrew" GitHub account has since been disabled, historical data and screenshots from the Internet Archive reveal that the hosted image was used to deliver a Go-based downloader. This downloader is responsible for retrieving the final stages of the attack, including the "movinlike" remote access tool and a Node.js-based stealer, from a command-and-control (C2) server located at the IP address 104.234.65[.]75.