Cybersecurity researchers have found a malicious npm bundle that is a part of a not too long ago disclosed software program provide chain assault marketing campaign dubbed MALFEX.
The bundle, named “imgdecode,” was uploaded to the bundle registry on September 30, 2026, by a consumer named “malfexteste8.” It has been downloaded 979 instances as of writing and remains to be accessible on npm as of writing. The newest model of the bundle is 1.0.3.
“The npm bundle imgdecode hides a malicious loader in a compiled Node.js addon,” SafeDep mentioned. “Its nine-line JavaScript file hundreds a Home windows dynamic-link library (DLL). When a Node.js program calls require(‘imgdecode’) from a Home windows console, the DLL makes an attempt to obtain encrypted shellcode from GitHub. It decrypts the response and injects the end result into a brand new dllhost.exe course of.”
First documented by each Checkmarx and CloudSEK, MALFEX is the title assigned to a long-running marketing campaign wherein an unknown risk actor has been publishing malicious packages to npm since August 6, 2023, with an intention to compromise Home windows techniques. These packages had been revealed throughout 5 npm writer handles: malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4.
Of the eight recognized packages, three had been discovered to behave as a loader for Overlord RAT, whereas three others (“cdn-img-fetch,” “img-to-native,” and “native-runner”) labored collectively to obtain and run a Node.js stealer. A 3rd an infection pathway concerned the usage of a postinstall hook to execute JavaScript able to contacting an exterior server and retrieving an unspecified next-stage binary.
Curiously, the risk actor behind the marketing campaign seems to be responding to public disclosures and npm removals by publishing replacements for “native-runner” and “img-to-native” inside two days within the type of “runhelper” and “imgbundle.” That very same day, the primary model of “imgdecode” was revealed. The timeline of occasions is as follows –
- September 26, 2026 – cdn-img-fetch, img-to-native, and native-runner 1.0.0 revealed
- September 28, 2026, at 4:06 p.m. UTC – npm removes native-runner and img-to-native
- September 30, 2026, at 3:29 a.m. UTC – imgbundle 1.0.0 revealed, changing img-to-native
- September 30, 2026, at 3:37 a.m. UTC – runhelper 1.0.0 revealed, changing native-runner
- September 30, 2026, at 4:13 p.m. UTC – runhelper unpublished
- September 30, 2026, at 10:32 p.m. UTC – imgdecode 1.0.0 revealed
- September 30, 2026, at 11:07 p.m. UTC – imgdecode 1.0.1 revealed
- October 1, 2026, at 5:48 p.m. UTC – imgdecode 1.0.2 revealed
- October 7, 2026, at 11:06 p.m. UTC – npm removes imgbundle
- October 8, 2026, at 1:03 p.m. UTC – npm removes cdn-img-fetch
- October 11, 2026, at 10:09 p.m. UTC – imgdecode 1.0.3 revealed
The Node.js stealer chain is notable for the truth that not one of the packages featured an set up hook. As an alternative, the malicious code runs when “native-runner” is loaded. The bundle lists “img-to-native” as its dependency, which, in flip, has “img-to-native” as a dependency.
The precise performance of every of those packages is beneath –
- cdn-img-fetch downloads “banner.png” from a GitHub repository (“cavecrew/proj”) and extracts an encrypted blob.
- img-to-native decrypts the blob utilizing the important thing “malfexteam2027” and writes the contents to disk as a Go executable (“%APPDATApercentMicrosoftWindowsnode_runtime_helper.exe”).
- native-runner executes the Go executable, which then downloads the stealer binary (“setup.exe” aka movinlike) from “104.234.65[.]75:700.”
“Runhelper,” marketed as a helper utility for “launching native binaries from Node.js tasks,” capabilities equally to “native-runner” in that it is designed to run malicious code. Its main accountability is to find a JPG file (“cdn-img-fetch/.runtime/rt.jpg”), extract shellcode from it, copy it into executable reminiscence, and run it utilizing Koffi, a Overseas Perform Interface (FFI) module for Node.js.
“Six hours after runhelper was unpublished, the operator revealed imgdecode with a compiled DLL to run the shellcode,” SafeDep mentioned. “From model 1.0.1, the DLL additionally downloads and decrypts the payload. Variations 1.0.1 and 1.0.2 nonetheless name require(‘imgbundle’) earlier than loading the DLL. Model 1.0.3 removes that dependency and desires no different MALFEX bundle.”
Like within the case of “runhelper,” model 1.0.0 of “imgdecode” waits for “imgbundle” to jot down a file on the location “cdn-img-fetch/.runtime/” and, as soon as it turns into accessible, reads its contents into reminiscence, and passes them to a local Node.js addon for decoding the information.
The addon is a 64-bit Microsoft Visible C++ (MSVC) DLL that first checks if it is working in a developer’s terminal, after which proceeds to fetch a JPG file (“banner.jpg”) from the identical repository (“cavecrew/proj”), decrypt the embedded payload utilizing the important thing “nif-runtime-2027,” and finally inject the output into “dllhost.exe.”
“After decryption, the DLL checks the primary bytes of the plaintext,” SafeDep defined. “In the event that they match a JPEG or PNG signature, the DLL stops. Inference: the operator might flip the loader off by serving encrypted content material that decrypts to a picture. Serving an odd picture would as an alternative usually trigger decryption to fail earlier than this test.”
Though the GitHub account “cavecrew” is not accessible, an Web Archive screenshot of the picture file dated October 6, 2026, reveals that it is the identical Go-based downloader used for retrieving the Node.js stealer and distant entry software (“movinlike”) from “104.234.65[.]75:700.”
The Node.js utility features a .env file containing a command-and-control (C2) deal with (“104.234.65[.]75:7007”) and a MALFEX license key, indicating the usage of a malware builder or licensing system to craft such payloads.
The malware runs anti-analysis checks that audit for the presence of digital machines, sandboxes, and evaluation instruments like Course of Monitor and Wireshark, earlier than harvesting recordsdata matching seed phrases and particular extensions (.kdbx, .pem, .ppk, and .env), in addition to knowledge from Chromium-based net browsers, Discord, Telegram, cryptocurrency wallets, and gaming apps (Steam, Epic Video games, Riot, Battle.web, Minecraft, and Ubisoft).
It may additionally set up a WebSocket connection to the C2 server, permitting it to simply accept instructions for shell execution, file switch, course of management, clipboard entry, screenshots, and mouse and keyboard enter. For persistence, it provides a Registry Run key and creates a scheduled process named “MicrosoftEdgeUpdateService.”
Builders who’ve put in any of the aforementioned packages ought to deal with their Home windows techniques as probably compromised, isolate them, test for persistence entries, rotate credentials, and switch funds to new wallets in the event that they seed phrases had been saved in them,
