MALFEX Campaign Publishes imgdecode npm Package with Hidden Shellcode Loader

Cybersecurity researchers have identified a new malicious npm package named imgdecode as part of the ongoing MALFEX software supply chain attack campaign. The package was uploaded to the registry on September 30, 2026, by the user malfexteste8 and remains available for download as of the latest report.

SafeDep stated that the package conceals a malicious loader within a compiled Node.js addon. A nine-line JavaScript file loads a Windows dynamic-link library, which attempts to download encrypted shellcode from GitHub. The code then decrypts the response and injects the payload into a newly created dllhost.exe process on the victim's system.

Campaign Context and Evolution

The MALFEX campaign was first documented by Checkmarx and CloudSEK as a long-running effort by an unknown threat actor. Since August 6, 2023, the actor has published malicious packages to npm with the specific aim of compromising Windows systems. The campaign has utilized five distinct publisher handles, including malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4.

Researchers identified eight packages in the campaign so far. Three acted as loaders for the Overlord remote access trojan, while three others—cdn-img-fetch, img-to-native, and native-runner—worked together to download and execute a Node.js stealer. A third infection pathway used a postinstall hook to run JavaScript that contacted an external server to retrieve an unspecified next-stage binary.

The threat actor appears to react quickly to public disclosures and removals. After npm removed native-runner and img-to-native on September 28, 2026, the actor published replacements named runhelper and imgbundle within two days. On the same day, the first version of imgdecode was published, followed by rapid version updates on September 30 and October 1, 2026.

Affected Systems and Exposure

The imgdecode package is specifically designed to target Windows systems running Node.js. When a Node.js program calls require('imgdecode') from a Windows console, the malicious DLL executes its payload. As of the writing of the report, the package had been downloaded 979 times. The latest version available is 1.0.3.

The campaign demonstrates a persistent ability to rotate package names and versions to evade detection. The rapid succession of uploads for imgdecode, including versions 1.0.0, 1.0.1, and subsequent updates, suggests an active effort to maintain infrastructure despite removal attempts by the registry administrators.

What should you do?

Security teams should audit their dependency trees for any packages associated with the MALFEX campaign or the specific user handles identified. Organizations should monitor for unusual outbound connections from Node.js processes, particularly those attempting to contact GitHub repositories or unknown external servers. Reviewing postinstall hooks for suspicious JavaScript execution is also critical.

Background: Malicious npm packages

Developers often ignore version pinning, skip package audits, and leave internal registries open. These errors allow attackers to push malicious code under similar names or older versions. Fix these gaps by enforcing strict version ranges, using private mirrors, and verifying package integrity before installation.

Read the full guide: Mistakes That Let Malicious npm Packages Compromise Your Build

What to do and how to stay safe: npm

• Audit npm dependency trees for packages published by known malicious handles such as malfexteste8 or those linked to the MALFEX campaign.
• Monitor network traffic for Node.js processes attempting to download payloads from GitHub or other unexpected external sources.
• Inspect package postinstall hooks for suspicious JavaScript code that contacts external servers or executes native binaries.
• Implement strict allowlisting for npm packages in production environments to prevent the installation of unverified or newly published modules.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What does the imgdecode package do?

It loads a Windows DLL that downloads encrypted shellcode from GitHub, decrypts it, and injects it into a new dllhost.exe process.

Who is behind the MALFEX campaign?

The threat actor is currently unknown, though the campaign has been active since August 2023 using multiple npm publisher handles.

Is the imgdecode package still available on npm?

Yes, the package remains available on the npm registry as of the time of the report, with version 1.0.3 being the latest.