Ethical Hacking News
Malicious npm package "imgdecode" hides a shellcode loader in a compiled Microsoft Visual C++ (MSVC) DLL. The package is part of a software supply chain attack campaign dubbed MALFEX and has been downloaded 979 times. The malicious code runs when "native-runner" is loaded, and the package lists "img-to-native" as its dependency. Developers who have installed the package should treat their Windows systems as potentially compromised.
Malicious npm package "imgdecode" discovered in September 2026 as part of the MALFEX campaign. Package contains a malicious loader that downloads and runs a Node.js stealer. Stealer malware establishes a WebSocket connection to a C2 server for command execution. Packages were published across five npm publisher handles, compromising Windows systems. Threat actor responds to public disclosures by publishing replacements within two days. NPM removals and package updates indicate a cat-and-mouse game between the threat actor and security researchers.
The world of cybersecurity is an ever-evolving landscape, with new threats emerging on a daily basis. Recently, cybersecurity researchers have discovered a malicious npm package that is part of a software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of the package is 1.0.3.
According to SafeDep, the npm package "imgdecode" hides a malicious loader in a compiled Microsoft Visual C++ (MSVC) DLL. This DLL first checks if it's running in a developer's terminal, and then proceeds to fetch a JPG file from the "cavecrew/proj" repository. The DLL then decrypts the embedded payload using the key "nif-runtime-2027" and ultimately injects the output into "dllhost.exe."
The Node.js application includes a .env file containing a command-and-control (C2) address and a MALFEX license key, indicating the use of a malware builder or licensing system to craft such payloads. The malware runs anti-analysis checks that audit for the presence of virtual machines, sandboxes, and analysis tools like Process Monitor and Wireshark, before harvesting files matching seed phrases and specific extensions.
The malware can establish a WebSocket connection to the C2 server, allowing it to accept commands for shell execution, file transfer, process control, clipboard access, screenshots, and mouse and keyboard input. For persistence, the malware adds a Registry Run key and creates a scheduled task named "MicrosoftEdgeUpdateService."
Developers who have installed any of the aforementioned packages should treat their Windows systems as potentially compromised, isolate them, check for persistence entries, rotate credentials, and transfer funds to new wallets if they seed phrases were stored in them.
The Node.js stealer chain is notable for the fact that none of the packages featured an install hook. Instead, the malicious code runs when "native-runner" is loaded. The package lists "img-to-native" as its dependency, which, in turn, has "img-to-native" as a dependency.
The exact functionality of each of these packages is as follows:
- cdn-img-fetch downloads "banner.png" from a GitHub repository ("cavecrew/proj") and extracts an encrypted blob.
- img-to-native decrypts the blob using the key "malfexteam2027" and writes the contents to disk as a Go executable ("%APPDATA%\Microsoft\Windows\node_runtime_helper.exe").
- native-runner executes the Go executable, which then downloads the stealer binary ("setup.exe" aka movinlike) from "104.234.65[.]75:700."
- runhelper functions similarly to "native-runner" in that it's designed to run malicious code. Its primary responsibility is to locate a JPG file ("cdn-img-fetch/.runtime/rt.jpg"), extract shellcode from it, copy it into executable memory, and run it using Koffi, a Foreign Function Interface (FFI) module for Node.js.
Interestingly, the threat actor behind the campaign appears to be responding to public disclosures and npm removals by publishing replacements for "native-runner" and "img-to-native" within two days in the form of "runhelper" and "imgbundle."
The timeline of events is as follows:
- September 26, 2026 - cdn-img-fetch, img-to-native, and native-runner 1.0.0 published
- September 28, 2026, at 4:06 p.m. UTC - npm removes native-runner and img-to-native
- September 30, 2026, at 3:29 a.m. UTC - imgbundle 1.0.0 published, replacing img-to-native
- September 30, 2026, at 3:37 a.m. UTC - runhelper 1.0.0 published, replacing native-runner
- September 30, 2026, at 4:13 p.m. UTC - runhelper unpublished
- September 30, 2026, at 10:32 p.m. UTC - imgdecode 1.0.0 published
- September 30, 2026, at 11:07 p.m. UTC - imgdecode 1.0.1 published
- October 1, 2026, at 5:48 p.m. UTC - imgdecode 1.0.2 published
- October 7, 2026, at 11:06 p.m. UTC - npm removes imgbundle
- October 8, 2026, at 1:03 p.m. UTC - npm removes cdn-img-fetch
- October 11, 2026, at 10:09 p.m. UTC - imgdecode 1.0.3 published
This campaign in which an unknown threat actor has been publishing malicious packages to npm since August 6, 2023, with an aim to compromise Windows systems, is known as MALFEX. These packages were published across five npm publisher handles: malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4.
Three of the eight identified packages were found to act as a loader for Overlord RAT, while three others ("cdn-img-fetch," "img-to-native," and "native-runner") worked together to download and run a Node.js stealer. A third infection pathway involved the use of a postinstall hook to execute JavaScript capable of contacting an external server and retrieving an unspecified next-stage binary.
The threat actor behind the campaign appears to be responding to public disclosures and npm removals by publishing replacements for "native-runner" and "img-to-native" within two days in the form of "runhelper" and "imgbundle."
Related Information:
https://www.ethicalhackingnews.com/articles/MALFEX-NPM-Package-imgdecode-Hides-Shellcode-Loader-in-Compelled-Microsoft-Visual-C-MSVC-DLL-ehn.shtml
https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html
https://www.b3ncloud.net/article/43889
https://www.socinvestigation.com/comprehensive-list-of-apt-threat-groups-motives-and-attack-methods/
https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html
https://securityarsenal.com/blog/malfex-npm-supply-chain-campaign-detecting-and-removing-the-overlord-rat-and-info-stealer-in-your-developer-environment
Published: Sat Oct 17 07:45:06 2026 by llama3.2 3B Q4_K_M
