"The npm package imgdecode hides a malicious loader in a compiled Node.js addon," SafeDep said.
How imgdecode loads a Windows DLL and what the DLL does
Researchers at SafeDep found that imgdecode — an npm package published on September 30, 2026, by the user malfexteste8 and downloaded 979 times as of this writing — bundles a compiled 64‑bit Microsoft Visual C++ DLL. The package's nine‑line JavaScript entry point loads that native addon; when a Node.js program calls require('imgdecode') from a Windows console, the DLL attempts to download an encrypted payload from a GitHub repository, decrypt it, and inject the resulting shellcode into a newly spawned dllhost.exe process.
The DLL includes anti‑analysis logic: it checks whether it is running in a developer's terminal and performs signature checks on decrypted plaintext. If the first bytes match a JPEG or PNG signature the loader stops — SafeDep notes this permits the operator to effectively turn the loader off by serving content that decrypts to an ordinary image.
MALFEX campaign timeline and related packages
SafeDep and earlier writeups by Checkmarx and CloudSEK place imgdecode inside a broader, long‑running supply chain campaign called MALFEX. The actor has published malicious packages to npm since August 6, 2023, using publisher handles including malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4.
- September 26, 2026 — cdn-img-fetch, img-to-native, and native-runner 1.0.0 published
- September 28, 2026, 16:06 UTC — npm removes native-runner and img-to-native
- September 30, 2026, 03:29 UTC — imgbundle 1.0.0 published (replacing img-to-native)
- September 30, 2026, 03:37 UTC — runhelper 1.0.0 published (replacing native-runner)
- September 30, 2026, 16:13 UTC — runhelper unpublished
- September 30, 2026, 22:32 UTC — imgdecode 1.0.0 published; followed by 1.0.1 (23:07), 1.0.2 (Oct 1, 17:48), and 1.0.3 (Oct 11, 22:09)
- October 7–8, 2026 — npm removes imgbundle and cdn-img-fetch
Different packages in the MALFEX set fulfilled different roles. cdn-img-fetch retrieved an encrypted blob (banner.png) from a GitHub repo (cavecrew/proj); img-to-native decrypted that blob with the key "malfexteam2027" and wrote a Go executable; native-runner executed the Go binary which fetched a stealer from 104.234.65[.]75:700. Runhelper and imgdecode are alternate loaders that extract shellcode from JPG files and run it via a native module or FFI.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageCapabilities of the deployed payloads
The Node.js application observed by analysts included a .env file with a command‑and‑control address, 104.234.65[.]75:7007, and a MALFEX license key — an indication the operator used a builder or licensed component to craft payloads. An archived screenshot of the GitHub "cavecrew" files shows a Go‑based downloader like the one used to fetch both the Node.js stealer and a remote access tool called "movinlike" from 104.234.65[.]75:700.
Once run, the malware performs multiple reconnaissance and exfiltration actions. It runs anti‑analysis checks for virtual machines, sandboxes, and analysis tools such as Process Monitor and Wireshark; harvests files matching seed phrases and extensions (.kdbx, .pem, .ppk, .env); and collects data from Chromium‑based browsers, Discord, Telegram, cryptocurrency wallets, and gaming applications including Steam, Epic Games, Riot, Battle.net, Minecraft, and Ubisoft.
The implanted payload can open a WebSocket to its C2 and accept commands for shell execution, file transfer, process control, clipboard access, screenshots, and mouse and keyboard input. For persistence the malware adds a Registry Run key and creates a scheduled task named "MicrosoftEdgeUpdateService."
What this means for developers, open‑source maintainers, and security teams
Developers who installed any of the MALFEX packages on Windows should consider the systems potentially compromised. The advisory recommends isolating affected machines, checking for persistence entries (Registry Run keys and scheduled tasks), rotating credentials, and transferring funds to new wallets if seed phrases were stored in the environment or on disk.
Open‑source maintainers and procurement teams should note the actor's rapid replacement strategy: when npm removed packages the operator published replacements within two days (runhelper, imgbundle, and then imgdecode), and later altered dependencies so imgdecode 1.0.3 “needs no other MALFEX package.” That sequence illustrates how attackers can iterate quickly to work around takedowns and dependency removals.
Conclusion — a practical, specific risk
Imgdecode is not a one‑off typo or an inert experiment: it is a compiled loader that downloads encrypted payloads, decrypts and inspects them, and can inject code into native Windows processes. The package is still available on npm as of this writing and the MALFEX pattern shows an operator prepared to publish rapid replacements. Developers and defenders should treat installs of the named packages as active compromises and take the concrete containment and credential‑rotation steps outlined above.
Source: https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html
