Malicious npm Package 'imgdecode' Hides Windows Shellcode Loader in Native DLL, Tied to MALFEX Campaign

A malicious npm package called imgdecode is the latest piece of MALFEX, a campaign that has targeted Windows developers since August 2023. The package carries no install script. Its loader sits inside a compiled Node.js addon.

SafeDep published its analysis on Oct. 13, 2026. At that point imgdecode had been downloaded 979 times and was still available on npm.

How imgdecode works

The package's JavaScript file is nine lines long. It loads a Windows dynamic-link library (DLL).

When a Node.js program calls `require('imgdecode')` from a Windows console, the DLL tries to download encrypted shellcode from GitHub, SafeDep said. It decrypts the response and injects the result into a new `dllhost.exe` process.

That design sidesteps the postinstall hooks many package scanners flag. Nothing fires at install time. The code runs when a developer's program loads the package.

SafeDep's analysis, as relayed by SOC Prime, says the payload was decrypted with the AES-256-CBC key `nif-runtime-2027`. SafeDep traced the chain to a Go-based downloader and then to a Windows stealer and remote access tool.

SafeDep did not recover the `banner.jpg` file the chain pulls down. It says the native loader's link to the final stealer payload is therefore an inference. The hash of the stage-2 downloader it did recover matches the Checkmarx indicator list, and SafeDep says that ties imgdecode to MALFEX with high confidence.

A campaign that keeps replacing what gets removed

Checkmarx published its analysis of MALFEX on Oct. 5, and CloudSEK documented it as well. They describe an unknown operator publishing malicious npm packages since Aug. 6, 2023, across five publisher handles: malfexkkj, malfex_user, malfexteste2, malfexteste3 and malfexteste4. Public reports link the operator to a Portuguese-speaking actor, SafeDep said.

The researchers identified eight packages. Three load the Overlord RAT. Three others, cdn-img-fetch, img-to-native and native-runner, work together to download and run a Node.js stealer. A third path uses a postinstall hook to contact an external server and pull an unspecified next-stage binary.

The operator adapts. According to SafeDep, npm removed native-runner and img-to-native on Sept. 28, and replacements appeared within two days: runhelper and imgbundle. The first version of imgdecode was uploaded on Sept. 30 by a user named malfexteste8.

Runhelper used the Koffi foreign function interface to pull shellcode out of a JPG file, copy it into executable memory and run it. Six hours after runhelper was unpublished, imgdecode appeared with a compiled DLL doing the same job, SafeDep said.

Version 1.0.1 added the GitHub download and decryption. Versions 1.0.1 and 1.0.2 still required imgbundle before loading the DLL. Version 1.0.3, published Oct. 11, drops that dependency and stands alone. That was six days after the Checkmarx report.

What was exposed, and how long

Other MALFEX packages sat unflagged for a long time. CloudSEK found that the malicious postinstall in the package function-flag went unflagged by advisory databases for 14 months. That package had 37,419 lifetime downloads.

SecurityWeek noted that the advisory for cdn-img-fetch covers only two of its four malicious versions. A clean advisory-database check does not clear a project.

CloudSEK also reports that the RAT reads its instructions from Solana blockchain transactions, which makes the control server harder to block.

No widely used package depends on these. The damage comes from developers installing them directly, so the exposure depends on whether someone typed the package name into a terminal. Four of the 12 packages tied to the operator were harmless, according to CloudSEK's findings as summarized by one security site. That mix helped the rest blend in.

What defenders are told to do

SOC Prime's guidance focuses on behavior. Watch for `node.exe` spawning `dllhost.exe`, unexpected connections to code repositories and unusual native addon loading. It also recommends restricting unverified npm packages in development environments and enforcing strict egress filtering.

If a workstation may have loaded a MALFEX package, SOC Prime says to isolate it from the network. Responders should capture memory before rebooting so the injected shellcode can be examined. Credentials should be rotated once the machine is contained, including browser passwords, Discord tokens and cloud provider keys.

Searching dependency trees, including indirect ones, for the eight packages named in the original disclosures is the first step. The packages are tlxbnhd, tldriver, mxdriver, cdn-img-fetch, img-to-native, native-runner, function-flag and function-color. That list does not include imgdecode, runhelper or imgbundle, so those names need their own search. The payloads run only on Windows, but install scripts in the older packages fire on any platform.

Open question

Npm took down the earlier loaders, and the operator replaced each within days. As of SafeDep's Oct. 13 analysis, imgdecode was still live at version 1.0.3. Whether npm has removed it since, and what the operator publishes next, is not established.