MALFEX Campaign Persists as Researchers Uncover Malicious Native Loader in Popular npm Registry

The sophistication of the MALFEX payloads suggests a highly organized operation. The Node.js application used in the attack includes a ".env" configuration file containing the C2 address and a unique "MALFEX license key." The presence of such a key indicates that the threat actor may be using a custom malware builder or a commercial "malware-as-a-service" platform to generate their payloads. This level of professionalization is increasingly common in modern supply chain attacks, where attackers treat their malicious software with the same rigor as legitimate software development.

Once a system is compromised, the MALFEX malware executes an extensive suite of anti-analysis checks. It audits the host for the presence of virtual machines, sandboxes, and common security tools such as Process Monitor and Wireshark. If it determines it is being analyzed, it may alter its behavior to avoid detection. If the environment is deemed "safe" for the attacker, the malware begins harvesting an array of sensitive data. This includes searching for files with specific extensions such as ".kdbx" (KeePass password databases), ".pem" and ".ppk" (cryptographic keys), and ".env" (configuration files often containing API keys and credentials).

Furthermore, the stealer targets a wide range of applications. It extracts data from Chromium-based web browsers, Discord, and Telegram, while also searching for cryptocurrency wallet information. Gamers are also at risk, as the malware targets data from platforms including Steam, Epic Games, Riot, Battle.net, Minecraft, and Ubisoft. To maintain control, the malware can establish a WebSocket connection to its C2 server, enabling the attacker to execute shell commands, transfer files, manage processes, access the clipboard, take screenshots, and even manipulate mouse and keyboard input.

To ensure long-term access, the MALFEX malware implements several persistence mechanisms. It adds a Registry Run key to ensure it launches upon system startup and creates a scheduled task deceptively named "MicrosoftEdgeUpdateService" to blend in with legitimate Windows background processes. This combination of stealth, data theft, and remote control makes the MALFEX campaign a severe threat to any developer who inadvertently includes these packages in their workflow.

Security experts advise that any developer who has installed or interacted with the "imgdecode," "runhelper," "imgbundle," or other associated MALFEX packages should immediately consider their Windows systems as fully compromised. Recommended remediation steps include isolating the affected machines from the network, auditing system persistence entries for suspicious registry keys or scheduled tasks, and rotating all credentials that may have been stored on the device. Given the malware’s focus on cryptocurrency wallets and seed phrases, individuals are also urged to transfer funds to new, secure wallets if any recovery phrases were stored in digital format on the compromised system. The MALFEX campaign remains a potent reminder of the vulnerabilities inherent in the modern software supply chain and the need for rigorous verification of third-party dependencies.