Skip to content
Hacker Posts

MALFEX npm campaign resurfaces with imgdecode loader

imgdecode, live on npm with 979 downloads, loads a Windows native addon that pulls shellcode from GitHub and injects it into dllhost.exe — the newest package in the MALFEX campaign.

Published 3 min read
malwarenpmsupply-chainthreat-intel

A malicious npm package named imgdecode has been loading a Windows shellcode stager since late September, and it was still installable when SafeDep published its analysis — reported by The Hacker News. It is the latest package in MALFEX, the long-running npm campaign Checkmarx Zero documented on October 5 in MALFEX npm Malware Campaign. No CVE applies; this is malware shipped as a dependency, not a flaw in one.

What imgdecode does

The package is a nine-line JavaScript file that loads a bundled Windows DLL — a compiled Node.js native addon. The DLL is a 64-bit MSVC build that first checks whether it is running in a developer's terminal, then fetches an image from the GitHub repo cavecrew/proj, decrypts an embedded payload with the key nif-runtime-2027, and injects the resulting shellcode into a freshly spawned dllhost.exe. If the decrypted data starts with a JPEG or PNG signature, the DLL stops — SafeDep reads this as a kill switch the operator can trip by serving a real image.

The final payload, setup.exe (also called movinlike), is a stealer and RAT: it harvests seed phrases, .kdbx, .pem, .ppk and .env files, browser data, and Discord and Telegram artifacts, then opens a WebSocket to its C2 for shell, file transfer and screen capture.

Affected package

  • imgdecode on npm, latest version 1.0.3, first published September 30, 2026 by user malfexteste8. 979 downloads at the time of writing, and still live.
  • Version 1.0.0 required the companion package imgbundle to stage its payload; 1.0.3 dropped that dependency.

Indicators

Per SafeDep's analysis, as reported by The Hacker News:

C2 / staging:   104.234.65[.]75 (C2 on port 7007)
Dropped file:   %APPDATA%\Microsoft\Windows\node_runtime_helper.exe
Payload:        setup.exe ("movinlike") — stealer + RAT
GitHub repo:    cavecrew/proj (account now removed)
Decrypt keys:   nif-runtime-2027 (imgdecode), malfexteam2027 (img-to-native)
Persistence:    Registry Run key + scheduled task "MicrosoftEdgeUpdateService"

What to do today

  1. Check your lockfiles for imgdecode and the related MALFEX packages — img-to-native, native-runner, cdn-img-fetch, runhelper, imgbundle, function-flag. npm has pulled several, but not all.
  2. Treat any host that installed one as compromised. Isolate it, check the Run key and the MicrosoftEdgeUpdateService task, and rotate credentials.
  3. Move funds if seed phrases or wallet files were ever stored on an affected machine.

Context

Checkmarx counts eight malicious packages out of twelve the operator has published since August 6, 2023, tied to a single adversary across five npm handles — one who, as the report's title puts it, "signs their work." imgdecode extends that run by weeks. It is the latest in a steady drip of npm supply-chain malware we have tracked, alongside typosquatted Arch AUR packages and the SlugFest trusted-publishing flaw. The constant: install-time or import-time code runs with the developer's privileges, and a benign-looking name buys the operator weeks before a takedown.

Related stories