Researchers have uncovered a dangerous npm package called imgdecode, part of a malicious campaign named MALFEX, that hides a shellcode loader inside a Windows native addon. Uploaded on September 30, 2026 under the username “malfexteste8,” the package had amassed nearly 1,000 downloads and remained available in npm’s registry at the time of discovery. The current version is 1.0.3.
How the Loader Works
The core of imgdecode is deceptively simple: a nine-line JavaScript file that loads a Windows dynamic-link library (DLL). When required by a Node.js application on Windows, this DLL reaches out to GitHub to download encrypted shellcode, decrypts it, and injects it into dllhost.exe, a legitimate system process. This allows the malware to run with normal-looking process names, masking its true nature in infection operations.
The Bigger MALFEX Supply Chain Campaign
MALFEX has been active since early August 2023, hijacking the npm supply chain through several fake publisher accounts like malfexkkj and malfexteste*. Over the course of the campaign, multiple packages have been used to deliver different malware stages: loaders for Overlord RAT, tools to steal data via Node.js, and components that execute binaries hidden in dependency chains.
The newer mutant, imgdecode, is especially concerning because it consolidates stages. Earlier packages such as cdn-img-fetch, img-to-native, and native-runner respectively downloaded encrypted blobs, decrypted payloads, and executed a Go-based stealer. When npm removed those, replacements were published—runhelper and imgbundle—shortly before imgdecode appeared. By version 1.0.3, imgdecode no longer relies on any other MALFEX package to deliver its malicious behavior.
The native addon (a 64-bit MSVC DLL) embedded in imgdecode performs several stealthy checks: it determines if it’s running in a developer’s terminal, then fetches a JPEG file from a GitHub repo (“cavecrew/proj”), decrypts content using the key “nif-runtime-2027”, checks for image signatures, and only proceeds if the payload is non-image shellcode. The decrypted payload is then injected into a dllhost.exe process.
Once active, MALFEX performs anti-analysis checks—for virtual machines, sandboxes, or tools like Wireshark. It scavenges for tools, seed phrase files, credentials from browsers, messaging apps, and gaming platforms. It also opens a WebSocket-based channel for remote commands, allows file transfers, clipboard access, screen captures, keystroke and mouse control, and establishes persistence through scheduled tasks and registry entries.
What To Do If You’re Impacted
Any Windows environment that installed cdn-img-fetch, img-to-native, native-runner, or any version of imgdecode should assume possible compromise. Best practices include isolating the system, scanning for persistence entries like registry run keys and scheduled tasks, rotating credentials, and transferring assets stored locally in wallets if seed phrases were present.
This threat highlights how supply-chain attacks are evolving—instead of simple malicious libraries, attackers now build multi-stage, cross-package operations that adapt rapidly to takedowns. The consolidation inside imgdecode shows the operator aiming for resilience.
Close monitoring of npm package publication behavior is crucial—look out for refactored or renamed packages, dependencies suddenly dropped or introduced, and surprisingly simple JS wrappers that import native components.
Ultimately, this kind of malware pushes the conversation beyond code hygiene. It demands stronger verification of package provenance, cryptographic signatures in open-source ecosystems, and enhanced alerting when packages make suspicious network calls or attempt to load native code.
