A recently discovered npm package, aptly named `imgdecode`, has been identified as a component of the persistent **MALFEX** software supply chain attack campaign. Uploaded on September 30, 2026, by a user `malfexteste8`, the package has already seen 979 downloads and remains active on the npm registry. ### How the 'imgdecode' Package Operates According to **SafeDep** researchers, the `imgdecode` package cleverly conceals a malicious loader within a compiled Node.js addon. Its minimal nine-line JavaScript file is designed to load a Windows dynamic-link library (**DLL**). When `require('imgdecode')` is executed from a Windows console, the **DLL** attempts to download encrypted shellcode from **GitHub**, decrypting and injecting it into a new `dllhost.exe` process.  ### The MALFEX Campaign: An Evolving Threat First documented by **Checkmarx** and **CloudSEK**, **MALFEX** refers to a long-running operation where an unidentified threat actor has been publishing malicious packages to npm since August 6, 2023. The campaign's primary objective is to compromise Windows systems, utilizing five distinct npm publisher handles: `malfexkkj`, `malfex_user`, `malfexteste2`, `malfexteste3`, and `malfexteste4`. Previous iterations of the campaign involved various infection pathways: * **Overlord RAT Loader**: Three identified packages served as loaders for the **Overlord RAT**. * **Node.js Stealer**: Another three packages (`cdn-img-fetch`, `img-to-native`, and `native-runner`) collaborated to download and execute a Node.js-based stealer. * **Postinstall Hooks**: A third method leveraged a `postinstall` hook to execute JavaScript, fetching an unspecified next-stage binary from an external server. ### Threat Actor's Adaptability Intriguingly, the threat actor behind **MALFEX** has shown remarkable agility, responding to public disclosures and npm removals by rapidly publishing replacement packages. For instance, `runhelper` and `imgbundle` were released within two days to replace `native-runner` and `img-to-native`, respectively. `imgdecode` itself emerged on the same day. Here's a timeline of the recent activity: * **September 26, 2026**: `cdn-img-fetch`, `img-to-native`, and `native-runner` 1.0.0 published. * **September 28, 2026, 4:06 p.m. UTC**: npm removes `native-runner` and `img-to-native`. * **September 30, 2026, 3:29 a.m. UTC**: `imgbundle` 1.0.0 published, replacing `img-to-native`. * **September 30, 2026, 3:37 a.m. UTC**: `runhelper` 1.0.0 published, replacing `native-runner`. * **September 30, 2026, 4:13 p.m. UTC**: `runhelper` unpublished. * **September 30, 2026, 10:32 p.m. UTC**: `imgdecode` 1.0.0 published. * **September 30, 2026, 11:07 p.m. UTC**: `imgdecode` 1.0.1 published. * **October 1, 2026, 5:48 p.m. UTC**: `imgdecode` 1.0.2 published. * **October 7, 2026, 11:06 p.m. UTC**: npm removes `imgbundle`. * **October 8, 2026, 1:03 p.m. UTC**: npm removes `cdn-img-fetch`. * **October 11, 2026, 10:09 p.m. UTC**: `imgdecode` 1.0.3 published. ### Deep Dive into the Node.js Stealer Chain Notably, the Node.js stealer chain operates without installation hooks. The malicious code activates when `native-runner` is loaded, which lists `img-to-native` as a dependency, creating a nested dependency structure. The functionality of these packages is as follows: * **`cdn-img-fetch`**: Downloads `banner.png` from a **GitHub** repository (`cavecrew/proj`) and extracts an encrypted blob. * **`img-to-native`**: Decrypts the blob using the key `malfexteam2027` and writes the contents to disk as a Go executable (`%APPDATA%\Microsoft\Windows\node_runtime_helper.exe`). * **`native-runner`**: Executes the Go executable, which then downloads the stealer binary (`setup.exe`, also known as `movinlike`) from `104.234.65[.]75:700`. `Runhelper`, marketed as a utility for launching native binaries, mimics `native-runner`'s malicious intent. It locates a JPG file (`cdn-img-fetch/.runtime/rt.jpg`), extracts shellcode, copies it into executable memory, and runs it using **Koffi**, a **Foreign Function Interface (FFI)** module for Node.js. Six hours after `runhelper` was unpublished, the operators released `imgdecode` with a compiled **DLL** to execute the shellcode. From version 1.0.1, the **DLL** also handles payload download and decryption. While versions 1.0.1 and 1.0.2 still called `require('imgbundle')`, version 1.0.3 removed this dependency, making it a standalone threat. Initial versions of `imgdecode` (like 1.0.0) awaited `imgbundle` to write a file to `cdn-img-fetch/.runtime/`. Once available, it would read the contents and pass them to a native Node.js addon for decoding. This addon, a 64-bit **Microsoft Visual C++ (MSVC) DLL**, first checks for a developer's terminal environment. It then fetches `banner.jpg` from the same `cavecrew/proj` repository, decrypts the embedded payload using the key `nif-runtime-2027`, and injects the output into `dllhost.exe`. **SafeDep** noted an interesting anti-analysis feature: after decryption, the **DLL** checks the plaintext's first bytes. If they match a JPEG or PNG signature, the **DLL** stops, suggesting a potential kill switch if the operator serves encrypted content that decrypts to an image. ### Payload and Persistence Although the **GitHub** account `cavecrew` is no longer active, an **Internet Archive** screenshot from October 6, 2026, confirms the image file contains the same Go-based downloader used for the Node.js stealer and **RAT** (`movinlike`) from `104.234.65[.]75:700`. The Node.js application includes a `.env` file containing a command-and-control (**C2**) address (`104.234.65[.]75:7007`) and a **MALFEX** license key, implying the use of a malware builder or licensing system. The malware incorporates anti-analysis checks for virtual machines, sandboxes, and tools like **Process Monitor** and **Wireshark**. It harvests sensitive files (e.g., `.kdbx`, `.pem`, `.ppk`, `.env`), data from Chromium browsers, **Discord**, **Telegram**, cryptocurrency wallets, and gaming applications (**Steam**, **Epic Games**, **Riot**, **Battle.net**, **Minecraft**, **Ubisoft**). For remote control, it establishes a **WebSocket** connection to the **C2** server, enabling shell execution, file transfer, process control, clipboard access, screenshots, and mouse/keyboard input. Persistence is achieved through a Registry Run key and a scheduled task named `MicrosoftEdgeUpdateService`. ### Recommendations for Developers Developers who have installed any of the aforementioned malicious packages should consider their Windows systems compromised. Immediate actions include: * Isolating affected systems. * Checking for persistence entries. * Rotating all credentials. * Transferring funds to new wallets if seed phrases were stored on the compromised system.