MALFEX Campaign Persists as Researchers Uncover Malicious Native Loader in Popular npm Registry

Cybersecurity researchers have identified a sophisticated new entry in the ongoing software supply chain attack campaign known as MALFEX, marking a significant escalation in the threat actor’s technical approach. The discovery involves a malicious npm package titled "imgdecode," which leverages native Node.js addons to bypass traditional security scans and compromise Windows environments. This latest development underscores the persistent nature of the MALFEX threat actor, who has been actively targeting the JavaScript ecosystem for over three years with a rotating arsenal of malicious packages designed to exfiltrate sensitive data and establish remote control over infected systems.

The package in question, "imgdecode," was first uploaded to the npm package registry on September 30, 2026, by a user operating under the handle "malfexteste8." Despite its malicious intent, the package managed to garner 979 downloads before being flagged by security professionals. As of the latest reports, the package reached version 1.0.3, demonstrating a rapid development cycle as the attacker refined the delivery mechanism to evade detection. The campaign’s longevity and the actor’s ability to quickly replace removed packages highlight a systemic challenge in securing open-source repositories against determined adversaries.

According to a detailed analysis by security firm SafeDep, the "imgdecode" package represents a departure from simpler, script-based malware. It utilizes a compiled Node.js native addon to hide its malicious loader, a tactic that significantly complicates static analysis. While the package includes a deceptive nine-line JavaScript file, its primary function is to load a Windows dynamic-link library (DLL). When a developer or an automated system executes a Node.js program that calls the "require(‘imgdecode’)" command from a Windows console, the underlying DLL is triggered. Once active, this DLL attempts to communicate with a GitHub repository to download encrypted shellcode, which it then decrypts and injects into a legitimate system process, specifically "dllhost.exe," to mask its presence on the host machine.

The MALFEX campaign is not a new phenomenon in the cybersecurity landscape. It was first documented by researchers at Checkmarx and CloudSEK, who identified it as a long-running operation aimed at compromising Windows-based development environments. Since at least August 6, 2023, the unknown threat actor behind MALFEX has been systematically publishing malicious packages to npm. These efforts have been distributed across a variety of publisher handles, including malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4. This multi-account strategy allows the attacker to maintain a presence on the registry even after individual accounts or packages are reported and removed.

The broader campaign has utilized several distinct infection pathways. In earlier iterations, researchers identified eight specific packages, three of which served as loaders for the Overlord Remote Access Trojan (RAT). Another set of three packages—"cdn-img-fetch," "img-to-native," and "native-runner"—operated in a coordinated chain to download and execute a Node.js-based stealer. A third, more traditional method involved the use of npm "postinstall" hooks, which automatically execute JavaScript code upon installation to contact external servers and retrieve secondary malicious binaries.

The adaptability of the MALFEX operator is perhaps the most concerning aspect of the campaign. Security analysts observed that the threat actor appears to closely monitor public disclosures and registry removals. Within just two days of "native-runner" and "img-to-native" being taken down, the operator published "runhelper" and "imgbundle" as functional replacements. On that same day, the first version of "imgdecode" was released, showing a clear intent to iterate on the delivery method to stay ahead of defenders.

The technical mechanics of the "runhelper" package provided a blueprint for the current "imgdecode" iteration. Marketed as a utility for launching native binaries within Node.js projects, "runhelper" was designed to locate a specific JPG file located at "cdn-img-fetch/.runtime/rt.jpg." This image file was not a standard graphic but a container for hidden shellcode. Using the Koffi module, a Foreign Function Interface (FFI) for Node.js, the package would extract the shellcode, copy it into executable memory, and run it. SafeDep noted that "imgdecode" was published a mere six hours after "runhelper" was unpublished, representing a direct evolution of this technique.

Starting with version 1.0.1 of "imgdecode," the attacker integrated the download and decryption logic directly into the compiled DLL. While early versions still relied on a secondary package called "imgbundle" to facilitate the attack, version 1.0.3 removed this dependency entirely, allowing "imgdecode" to function as a standalone threat. This transition to a self-contained native addon makes the package much harder for standard npm security tools to analyze, as the malicious logic is locked away in binary format rather than readable JavaScript.

The specific addon used in "imgdecode" is a 64-bit Microsoft Visual C++ (MSVC) DLL. Upon execution, the DLL performs a series of environment checks to determine if it is running in a developer’s terminal. If the conditions are met, it proceeds to fetch a file named "banner.jpg" from a GitHub repository owned by a user named "cavecrew." The DLL then decrypts the payload embedded within the image using the hardcoded key "nif-runtime-2027." Interestingly, the malware includes a check to see if the decrypted plaintext matches a standard JPEG or PNG signature. If the resulting data appears to be a legitimate image, the DLL halts execution. Researchers believe this is a "kill-switch" mechanism, allowing the operator to deactivate the loader by simply replacing the encrypted payload on GitHub with a standard image file.

Although the "cavecrew" GitHub account has since been disabled, historical data and screenshots from the Internet Archive reveal that the hosted image was used to deliver a Go-based downloader. This downloader is responsible for retrieving the final stages of the attack, including the "movinlike" remote access tool and a Node.js-based stealer, from a command-and-control (C2) server located at the IP address 104.234.65[.]75.

The sophistication of the MALFEX payloads suggests a highly organized operation. The Node.js application used in the attack includes a ".env" configuration file containing the C2 address and a unique "MALFEX license key." The presence of such a key indicates that the threat actor may be using a custom malware builder or a commercial "malware-as-a-service" platform to generate their payloads. This level of professionalization is increasingly common in modern supply chain attacks, where attackers treat their malicious software with the same rigor as legitimate software development.

Once a system is compromised, the MALFEX malware executes an extensive suite of anti-analysis checks. It audits the host for the presence of virtual machines, sandboxes, and common security tools such as Process Monitor and Wireshark. If it determines it is being analyzed, it may alter its behavior to avoid detection. If the environment is deemed "safe" for the attacker, the malware begins harvesting an array of sensitive data. This includes searching for files with specific extensions such as ".kdbx" (KeePass password databases), ".pem" and ".ppk" (cryptographic keys), and ".env" (configuration files often containing API keys and credentials).

Furthermore, the stealer targets a wide range of applications. It extracts data from Chromium-based web browsers, Discord, and Telegram, while also searching for cryptocurrency wallet information. Gamers are also at risk, as the malware targets data from platforms including Steam, Epic Games, Riot, Battle.net, Minecraft, and Ubisoft. To maintain control, the malware can establish a WebSocket connection to its C2 server, enabling the attacker to execute shell commands, transfer files, manage processes, access the clipboard, take screenshots, and even manipulate mouse and keyboard input.

To ensure long-term access, the MALFEX malware implements several persistence mechanisms. It adds a Registry Run key to ensure it launches upon system startup and creates a scheduled task deceptively named "MicrosoftEdgeUpdateService" to blend in with legitimate Windows background processes. This combination of stealth, data theft, and remote control makes the MALFEX campaign a severe threat to any developer who inadvertently includes these packages in their workflow.

Security experts advise that any developer who has installed or interacted with the "imgdecode," "runhelper," "imgbundle," or other associated MALFEX packages should immediately consider their Windows systems as fully compromised. Recommended remediation steps include isolating the affected machines from the network, auditing system persistence entries for suspicious registry keys or scheduled tasks, and rotating all credentials that may have been stored on the device. Given the malware’s focus on cryptocurrency wallets and seed phrases, individuals are also urged to transfer funds to new, secure wallets if any recovery phrases were stored in digital format on the compromised system. The MALFEX campaign remains a potent reminder of the vulnerabilities inherent in the modern software supply chain and the need for rigorous verification of third-party dependencies.