Organisations face persistent threat from imgdecode npm package still hosting encrypted shellcode loader

The MALFEX supply chain campaign targets Windows systems through the npm registry. According to The Hacker News, the latest iteration involves the imgdecode package. This module hides a malicious loader inside a compiled Node.js addon. When developers import the package on Windows, it triggers a chain of events that downloads and executes remote code.

How does the imgdecode package operate?

The package relies on a nine-line JavaScript file that loads a Windows dynamic-link library. According to SafeDep, calling require('imgdecode') from a Windows console initiates the attack. The DLL contacts GitHub to download encrypted shellcode. It then decrypts the response and injects the resulting code into a new dllhost.exe process. This method allows the malicious code to run within a legitimate system process.

What is the history of the MALFEX campaign?

First documented by Checkmarx and CloudSEK, the MALFEX campaign has been active since August 2023. The threat actor uses multiple npm publisher handles to distribute malicious packages. Previous packages served as loaders for the Overlord RAT or worked together to deploy a Node.js stealer. Other infections used postinstall hooks to contact external servers and retrieve next-stage binaries. The actor consistently targets Windows environments through these supply chain vectors.

How does the threat actor respond to takedowns?

The actor demonstrates agility by replacing removed packages within days. According to The Hacker News, after npm removed native-runner and img-to-native on September 28, 2026, the actor published runhelper and imgbundle on September 30. The imgdecode package was published later that same day. The source notes the actor appears to be responding to public disclosures and npm removals by publishing replacements.

What is the current status of the package?

As of the report, the imgdecode package version 1.0.3 is still available on npm. It has been downloaded 979 times. The package was published by the user malfexteste8. The timeline shows multiple versions published in rapid succession on September 30 and October 1, 2026. The package remains online as of the writing of the report.

What analysts watch for

Security teams should monitor for unexpected network connections from development environments to GitHub or other code hosting platforms. Analysts typically examine Node.js addons for signed certificates and verify their origin. They check for processes like dllhost.exe spawning from unexpected parent processes. Reviewing package dependencies for recently added or unknown modules helps identify supply chain compromises. Teams should also look for scripts executing during installation phases that contact external endpoints.

What to do and how to stay safe: MALFEX

• Audit npm dependencies for packages with low download counts or unknown publishers.
• Verify that Node.js addons are from trusted sources and have valid signatures.
• Monitor for unexpected outbound connections from build servers or development workstations.
• Implement strict allowlists for package installations in production environments.

Step-by-step guide: Account Takeover vs Identity Theft: The Critical Difference

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is the imgdecode package safe to use?

No, it contains a hidden loader that downloads and executes encrypted shellcode on Windows systems.

Who is behind the MALFEX campaign?

The threat actor is unknown but uses multiple npm handles and has been active since 2023.

What happens when a developer installs imgdecode?

It loads a DLL that downloads encrypted shellcode from GitHub and injects it into a process.