MALFEX Malware Campaign: Malicious npm Package imgdecode Hides Windows Shellcode Loader

Cybersecurity researchers have discovered imgdecode, a malicious npm package linked to the MALFEX software supply chain attack campaign. The package hides a shellcode loader inside a compiled Windows native addon, potentially exposing developers to credential theft, remote access and data exfiltration.

According to research published by SafeDep and reported by The Hacker News, imgdecode was first published on September 30, 2026. Its latest reported version, 1.0.3, removes dependencies on other MALFEX packages, allowing it to operate independently.

How the imgdecode npm Package Works

The package contains a small JavaScript entry point that loads a compiled Windows Dynamic-Link Library (DLL). When a Node.js application imports the package in the relevant Windows environment, the native component attempts to retrieve encrypted payload data hosted on GitHub.

The DLL decrypts the retrieved content and injects the resulting shellcode into a new dllhost.exe process. This technique can help malicious code execute while making its activity harder for developers to recognise during routine application development.

Earlier versions also depended on other MALFEX packages, including imgbundle. Version 1.0.3 reportedly removes that dependency, simplifying the infection chain.

A Wider Software Supply Chain Attack

MALFEX is a campaign involving malicious npm packages published since August 2023. Researchers have identified multiple publisher accounts and several infection methods targeting Windows systems.

Some packages reportedly delivered Overlord RAT, while others worked together to download and execute information-stealing malware. The campaign has also used package dependencies and runtime execution to trigger malicious activity without relying on a conventional installation hook.

Researchers observed that the threat actor published replacement packages after earlier packages were removed from npm. This behaviour illustrates how quickly software supply chain threats can evolve following public disclosures and defensive action.

What Can the Malware Steal?

The associated malware reportedly targets sensitive information, including environment files, private keys, cryptocurrency wallet recovery phrases and files with extensions such as .kdbx, .pem and .ppk.

It can also target information from Chromium-based browsers, messaging applications, cryptocurrency wallets and gaming platforms. Reported remote-access capabilities include command execution, file transfers, process control, clipboard access and screenshots.

Additional capabilities include anti-analysis checks, registry-based persistence and a scheduled task named MicrosoftEdgeUpdateService.

These functions can create serious risks for developers whose workstations contain source code, API credentials, cloud access tokens or other confidential information.

How Developers Can Protect Themselves

Developers should verify npm package names, publisher histories, dependencies and repository links before adding unfamiliar packages. Software composition analysis and lockfiles can help teams identify unexpected dependencies and maintain consistent builds.

If imgdecode or another identified MALFEX package has been installed, affected Windows systems should be treated as potentially compromised. Disconnect them from sensitive networks, preserve relevant logs and investigate suspicious processes, scheduled tasks and registry entries.

Rotate potentially exposed credentials from a clean device, revoke affected tokens and review cloud and repository access. If cryptocurrency recovery phrases may have been compromised, follow a trusted wallet-security recovery process.

Conclusion

The MALFEX campaign demonstrates how malicious npm packages can disguise malware inside ordinary development components. A seemingly harmless dependency may introduce remote-access functionality and expose sensitive information.

Developers should adopt strict dependency controls, monitor package changes and investigate unexpected network activity. In software supply chain security, verifying what enters a project is as important as securing the application itself.

Sources: The Hacker News | SafeDep technical analysis | npm package: imgdecode