Cybersecurity
imgdecode hid shellcode loader in Windows addon
SafeDep said the npm package imgdecode concealed a Windows loader in a Node.js addon, and linked it to the wider MALFEX campaign that had targeted Windows systems since 2023.
- SafeDep said imgdecode was a malicious npm package linked to MALFEX.
- The package was uploaded on 30 September 2026 by the user handle malfexteste8, had 979 downloads, and version 1.0.3 was still available when the article was written.
- SafeDep said version 1.0.0 used a compiled Node.js addon and a DLL to fetch encrypted shellcode from GitHub and inject it into dllhost.exe.
- Checkmarx and CloudSEK had previously documented MALFEX, which the article said had used several npm publisher handles and packages including cdn-img-fetch, img-to-native, native-runner, runhelper and imgbundle.
SafeDep said the npm package imgdecode was part of the MALFEX campaign. The article said it had been uploaded on 30 September 2026 by malfexteste8, had reached 979 downloads, and was still present on npm at the time of writing.
According to SafeDep, imgdecode hid a malicious loader inside a compiled Node.js addon. It said a small JavaScript file loaded a Windows DLL, which then retrieved encrypted shellcode from GitHub, decrypted it and injected the result into dllhost.exe.
The article said Checkmarx and CloudSEK had already identified MALFEX as a long-running campaign against Windows systems. It said the packages had been published through five npm publisher handles, and that some of the earlier packages loaded Overlord RAT while others delivered a Node.js stealer.
The piece also described replacement packages published after removals, including runhelper and imgbundle, before imgdecode appeared. SafeDep said version 1.0.3 no longer needed other MALFEX packages, while earlier versions still depended on imgbundle before loading the DLL.
The article said the malware also checked for virtual machines and analysis tools, collected selected files and data from browsers, messaging apps and wallets, and could accept remote commands over a WebSocket connection. It said the operator also used a registry Run key and a scheduled task for persistence.
Named in this story
People
- malfexteste8
- the user handle that uploaded imgdecode
Companies
- SafeDep
- said the package hid a malicious loader
- Checkmarx
- first documented the MALFEX campaign
- CloudSEK
- first documented the MALFEX campaign
Organisations
- npm
- hosted and removed the packages
- MALFEX
- the campaign name for the malicious npm packages
Products and systems
- imgdecode
- the npm package that hid the shellcode loader
- cdn-img-fetch
- one of the earlier malicious npm packages
- img-to-native
- one of the earlier malicious npm packages
- native-runner
- a package used to trigger the malicious chain
- runhelper
- a replacement package that ran malicious code
- imgbundle
- a replacement package used in the chain
- Overlord RAT
- a remote access tool loaded by some packages
- Koffi
- the Node.js FFI module used to run shellcode
- Node.js
- the runtime used by the packages
- Windows
- the operating system the campaign targeted
How the source tells it
The source used a warning-heavy security register, with alarm and urgency carried by repeated compromise language and immediate mitigation advice.
- alarm repeated compromise language and a detailed attack chain were used to stress risk
- urgency the piece ended with direct advice to isolate systems, check persistence and rotate credentials