MALFEX Keeps Shipping: npm Package "imgdecode" Hides a Shellcode Loader in a Native Windows Addon

A long-running npm malware operation tracked as MALFEX has resurfaced with a stealthier delivery trick: instead of shipping its malicious logic as readable JavaScript, the newest package, imgdecode, tucks it into a compiled Node.js native addon — a Windows DLL that fetches encrypted shellcode and injects it into a legitimate system process.

What happened

imgdecode appeared on npm on 30 September 2026 under the publisher account malfexteste8. At the time of reporting it had close to 1,000 downloads, was still live on the registry, and had reached version 1.0.3.

On the surface the package is almost empty — a JavaScript file of just a few lines. Its only real job is to load a bundled DLL. When a developer calls require('imgdecode') from a Windows console, the DLL:

1. checks that it is running inside a developer's terminal,
2. pulls an image file from an attacker-controlled GitHub repository (cavecrew/proj),
3. decrypts a payload hidden inside that image, and
4. injects the resulting shellcode into a freshly spawned dllhost.exe process.

The loader also contains a quiet "off switch": if the decrypted content turns out to be a JPEG or PNG, it stops. That suggests the operator can disable the loader remotely just by changing what the repository serves.

A campaign that adapts in real time

MALFEX is not new. The cluster — previously documented by Checkmarx and CloudSEK, and analysed in this latest round by SafeDep — has been pushing malicious packages to npm since August 2023, consistently aimed at Windows machines. The actor behind it has not been identified.

The recent activity shows an operator watching takedowns closely:

• 26 Sep 2026 – cdn-img-fetch, img-to-native and native-runner published.
• 28 Sep – npm removes native-runner and img-to-native.
• 30 Sep – replacements imgbundle and runhelper appear within hours; runhelper is pulled the same afternoon; imgdecode 1.0.0 lands that evening.
• 1–11 Oct – imgdecode iterates to 1.0.3, while npm removes imgbundle and cdn-img-fetch.

Each version reduced dependencies on the other packages, until 1.0.3 runs completely on its own.

The earlier three-package chain is worth noting too: none of the packages used an install hook. The malicious code ran only when the package was actually loaded — a deliberate way to slip past defences that focus on postinstall scripts. That chain decrypted and dropped a Go-based downloader to %APPDATA%\Microsoft\Windows\node_runtime_helper.exe, which then fetched a Node.js stealer.

What the payload does

The final-stage Node.js implant is a full-featured stealer and remote access tool:

• Anti-analysis – looks for virtual machines, sandboxes and tools such as Process Monitor and Wireshark before doing anything.
• Data theft – harvests crypto seed phrases, files ending in .kdbx, .pem, .ppk and .env, Chromium browser data, Discord and Telegram data, crypto wallets, and accounts for Steam, Epic Games, Riot, Battle.net, Minecraft and Ubisoft.
• Remote control – a WebSocket channel to its command server lets the operator run shell commands, move files, manage processes, read the clipboard, take screenshots and drive mouse and keyboard.
• Persistence – a Registry Run key plus a scheduled task disguised as MicrosoftEdgeUpdateService.

A bundled configuration file carried a MALFEX "license key", which points to a builder or malware-as-a-service model behind the payloads.

Why it matters

Developer workstations are high-value targets: they hold SSH keys, cloud credentials, .env secrets, password vaults and signing material. Native addons are a blind spot for many review processes, because a quick glance at the JavaScript shows nothing suspicious — the payload sits in a binary that few people disassemble. Combine that with an operator who republishes within hours of a takedown, and blocklists alone will always lag behind.

What to do

• Hunt for the packages. Search lockfiles, caches and CI logs for imgdecode, imgbundle, runhelper, cdn-img-fetch, img-to-native and native-runner, and for any packages published by malfex* accounts.
• Treat affected Windows hosts as compromised. Isolate them, look for the MicrosoftEdgeUpdateService scheduled task, unexpected Run keys, node_runtime_helper.exe under %APPDATA%, and outbound connections to 104.234.65[.]75.
• Rotate everything that lived on the machine — SSH and API keys, cloud tokens, .env secrets, browser-saved passwords, and move funds to fresh wallets if seed phrases were stored there.
• Raise the bar for new dependencies. Flag packages that ship prebuilt .node/.dll binaries, are only days old, or come from brand-new publishers; pin versions and use a vetted internal registry or allowlist where possible.
• Don't rely on install-hook checks alone — this campaign deliberately avoids them.

Catching this class of problem early is exactly what dependency analysis in an AI-assisted code review is for: reviewing what your projects actually pull in — including new, low-reputation and binary-carrying packages — before it reaches a developer's laptop or your build pipeline.

Research credit: SafeDep (latest analysis), with earlier MALFEX reporting by Checkmarx and CloudSEK. Originally reported by The Hacker News.