Full Report
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of
Analysis Summary
# Tool/Technique: MALFEX npm Supply Chain Campaign (imgdecode Loader)
## Overview
MALFEX is a long-running software supply chain campaign in which an unknown threat actor has published malicious npm packages since August 6, 2023, to compromise Windows systems. The `imgdecode` package (uploaded September 30, 2026, by the publisher "malfexteste8") is a Node.js native addon that hides a DLL-based shellcode loader. When a Windows user runs `require('imgdecode')` from a Node.js program, the DLL downloads encrypted shellcode from GitHub, decrypts it, and injects it into a new `dllhost.exe` process. Checkmarx and CloudSEK first documented the campaign, and SafeDep analyzed `imgdecode`. The article notes the package had 979 downloads at the time of writing.
## Technical Details
- **Type:** Malware campaign comprising loaders and staged payloads (npm loader package, native DLL, shellcode); associated families include Overlord RAT and a Node.js stealer (movinlike)
- **Platform:** Windows (primary target); Node.js runtime as the delivery vector
- **Capabilities:** Dropper/loader, encrypted payload retrieval from GitHub, in-memory shellcode execution, process injection, staged delivery of RAT and stealer payloads
- **First Seen:** Campaign activity since August 6, 2023; `imgdecode` first published September 30, 2026
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain
- **TA0002 - Execution**
- T1059.007 - Command and Scripting Interpreter: JavaScript (malicious Node.js code, postinstall hook in one pathway)
- T1055 - Process Injection (shellcode injected into a new `dllhost.exe`)
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (encrypted shellcode and blobs)
- T1027.003 - Steganography (shellcode extracted from a JPG, `rt.jpg`)
- T1140 - Deobfuscate/Decode Files or Information (runtime decryption with a hardcoded key)
- T1036.005 - Masquerading: Match Legitimate Name or Location (`node_runtime_helper.exe` under `%APPDATA%\Microsoft\Windows\`)
- T1620 - Reflective Code Loading (shellcode copied into executable memory, per the `runhelper` chain)
- **TA0011 - Command and Control**
- T1105 - Ingress Tool Transfer (encrypted shellcode and stealer binaries downloaded)
- T1071.001 - Application Layer Protocol: Web Protocols (GitHub and HTTP-based retrieval)
## Functionality
### Core Capabilities
- Loads a Windows DLL from a nine-line JavaScript file in a compiled Node.js addon
- Downloads encrypted shellcode from GitHub, decrypts it, and injects it into `dllhost.exe`
- Downloads and runs a Node.js stealer (movinlike/`setup.exe`) from a remote server (chain via `native-runner`)
- Extracts a Go executable from an encrypted blob using the key "malfexteam2027" (chain via `img-to-native`)
- Extracts shellcode from a JPG and executes it through Koffi, a Node.js FFI module (`runhelper`)
- Delivers Overlord RAT through a loader chain (three of the eight identified packages)
### Advanced Features
- **Staged, modular delivery:** Each package has a narrow role (`cdn-img-fetch`, `img-to-native`, `native-runner`, `runhelper`, `imgbundle`, `imgdecode`), which complicates attribution and detection.
- **Evasion through no-install-hook design:** The stealer chain avoids `preinstall`/`postinstall` hooks and runs when the package is loaded, with a self-referencing dependency structure.
- **Rapid replacement:** After npm removals, the operator published replacement packages within about two days.
- **Version evolution:** From v1.0.1, the `imgdecode` DLL downloads and decrypts the payload itself. v1.0.3 removes the dependency on other MALFEX packages and works standalone.
- **Living-off-the-land process choice:** Injection targets `dllhost.exe`, a legitimate COM surrogate process.
## Indicators of Compromise
- **File Hashes:** Not provided in the article (truncated). Obtain hashes from the SafeDep, Checkmarx, and CloudSEK reports.
- **File Names:**
- `imgdecode` (npm package, v1.0.0–1.0.3)
- `cdn-img-fetch`, `img-to-native`, `native-runner`, `runhelper`, `imgbundle` (npm packages)
- `node_runtime_helper.exe` (`%APPDATA%\Microsoft\Windows\`)
- `rt.jpg` (`cdn-img-fetch/.runtime/rt.jpg`)
- `setup.exe` (movinlike stealer)
- **Registry Keys:** None reported
- **Network Indicators:**
- GitHub repository: hxxps://github[.]com/cavecrew/proj (payload source)
- IP address: 104[.]234[.]65[.]75 on port 700 (stealer download)
- npm publisher handles: malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4, malfexteste8
- **Behavioral Indicators:**
- `node.exe` loading a Windows DLL from a native addon
- `node.exe` or child processes making outbound requests to GitHub for binary or encrypted content
- Creation of `node_runtime_helper.exe` in `%APPDATA%\Microsoft\Windows\`
- `dllhost.exe` launched or injected from a Node.js process
- Node.js processes allocating executable memory and running shellcode via FFI (Koffi)
- Outbound connections to a non-standard port (700) on the stealer's IP
## Associated Threat Actors
- **Unknown threat actor** behind MALFEX, operating under at least six npm publisher handles. No named group was attributed in the article.
## Detection Methods
### Signature-based Detection
- Hash-based blocking of the DLL, Go executable, stealer, and Overlord RAT samples (obtain from vendor reports)
- Block or alert on the IP 104[.]234[.]65[.]75 and the associated GitHub repository path
- Check dependency trees and lockfiles (`package-lock.json`, `yarn.lock`) for the package names above
### Behavioral Detection
- Alert on `node.exe` spawning `dllhost.exe`, or on node processes performing `VirtualAlloc`/`VirtualProtect`-style executable memory allocation
- Alert on file creation of `node_runtime_helper.exe` in `%APPDATA%\Microsoft\Windows\`
- Alert on Node.js processes making HTTP requests to GitHub raw content followed by DLL or shellcode execution
- Alert on outbound connections to port 700 from developer workstations
- Flag Node.js processes loading unsigned native addons (`.node` files) from npm package directories
### YARA Rules
- None provided in the article. Write rules targeting the DLL's decryption routine and the hardcoded key string "malfexteam2027" once samples are obtained.
## Mitigation Strategies
### Prevention Measures
- Remove the identified packages and audit all projects for them, including transitive dependencies
- Block the IP address and the GitHub path at the egress proxy or firewall
- Restrict execution of Node.js native addons on endpoints where they're not needed
- Use an internal npm proxy or registry that blocks unverified or newly published packages (for example, packages less than 30 days old)
- Pin dependency versions and verify integrity hashes in lockfiles
### Hardening Recommendations
- Enforce application control (AppLocker or WDAC) to block unsigned binaries from `%APPDATA%`
- Monitor and restrict `dllhost.exe` child process creation and injection patterns with EDR
- Require approval for new npm dependencies and review install scripts (`preinstall`, `postinstall`)
- Run developer tools with least privilege and segment build environments from corporate endpoints
- Check for signs of compromise on any system where these packages were loaded, including credential theft and RAT persistence
## Related Tools/Techniques
- **Overlord RAT:** Remote access trojan delivered by three MALFEX loader packages
- **movinlike (setup.exe):** Node.js-based stealer retrieved from the MALFEX infrastructure
- **Koffi:** Legitimate Node.js FFI module abused by `runhelper` to execute shellcode
- **Other npm supply chain campaigns:** Similar tactics of malicious packages with staged payloads and rapid republishing, though the article does not name specific campaigns for comparison.
---
*Note: The source article is truncated, so some details (hashes, full IOC list, and persistence mechanisms) are unavailable. Consult the SafeDep, Checkmarx, and CloudSEK reports for complete technical data.*