Affected Systems

npm package 'imgdecode' versions 1.0.0 through 1.0.3, published by user 'malfexteste8'. Part of broader MALFEX campaign targeting Windows systems via npm supply chain. Downloaded 979 times. Package was still available on npm as of October 17, 2026.

Exploitation Status

Active campaign. The threat actor is actively responding to npm removals by publishing replacement packages within days. The 'imgdecode' package was published September 30, 2026, and updated through October 11, 2026 (version 1.0.3). Delivers Go-based downloader that retrieves stealer binary and Overlord RAT from 104.234.65[.]75:700. Campaign has been active since August 6, 2023.

Business Impact

Organizations using Node.js on Windows are at risk of credential theft and remote access compromise. The malware chain downloads encrypted shellcode from GitHub, decrypts it, and injects into dllhost.exe to deliver a stealer (movinlike) and Overlord RAT. The stealer includes anti-analysis checks for VMs, sandboxes, Process Monitor, and Wireshark. C2 infrastructure at 104.234.65[.]75:7007. The threat actor demonstrates persistence by rapidly publishing replacement packages after npm removals, indicating sustained targeting of the npm ecosystem.

Urgency

đź”´ Immediate

Recommended Actions

  • Audit all Node.js projects for dependencies on 'imgdecode', 'imgbundle', 'runhelper', 'cdn-img-fetch', 'img-to-native', and 'native-runner' packages; remove immediately if found
  • Block network connections to 104.234.65[.]75 (ports 700 and 7007) at firewall and proxy level
  • Search endpoint logs for execution of node_runtime_helper.exe from %APPDATA%\Microsoft\Windows\ and setup.exe (movinlike binary)
  • Monitor npm publisher accounts malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4, and malfexteste8 for new package publications
  • Implement npm package integrity checks and restrict installation to vetted registries or private mirrors with security scanning

---

# Threat Actor Context

Actor Profile

MALFEX is a long-running software supply chain attack campaign attributed to an unknown threat actor active since August 6, 2023. The actor targets the npm ecosystem by publishing malicious packages designed to compromise Windows systems. The campaign demonstrates adaptive OPSEC, with the threat actor rapidly publishing replacement packages within days of npm removals and public disclosures. Evidence of a malware builder or licensing system (indicated by "MALFEX license key" in .env files) suggests a potentially organized operation. The actor operates across multiple npm publisher handles (malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4, malfexteste8) and maintains infrastructure including GitHub repositories (cavecrew/proj) and C2 servers (104.234.65[.]75).

TTPs (Tactics, Techniques, Procedures)

The campaign employs multiple infection pathways: (1) Shellcode injection via compiled Node.js native addons (DLLs) that decrypt and inject payloads into dllhost.exe; (2) Multi-stage loaders using dependency chains where packages download encrypted blobs from GitHub, decrypt using hardcoded keys ("malfexteam2027", "nif-runtime-2027"), and execute Go-based downloaders; (3) Postinstall hooks executing JavaScript for next-stage retrieval. The malware uses steganography (embedding payloads in JPG/PNG files), Foreign Function Interface (FFI) modules (Koffi) for shellcode execution, and deploys both Overlord RAT and custom Node.js stealers. Anti-analysis techniques include VM/sandbox detection and checks for analysis tools (Process Monitor, Wireshark). The actor demonstrates operational agility by iterating package versions and removing dependencies to evade detection. Relevant MITRE ATT&CK techniques include T1195.002 (Compromise Software Supply Chain), T1055 (Process Injection), T1027 (Obfuscated Files or Information), T1140 (Deobfuscate/Decode Files or Information), and T1497 (Virtualization/Sandbox Evasion).

Targets & Patterns

The MALFEX campaign specifically targets software development organizations and individual developers using Windows systems within the Node.js/npm ecosystem. The focus on the software development sector is strategic, as compromising developer environments enables broader supply chain attacks affecting downstream customers. The malware only activates on Windows platforms and includes checks to verify execution in developer terminals, indicating targeting of active development environments rather than production systems. The 979 downloads of imgdecode alone, combined with multiple package iterations since 2023, suggests opportunistic targeting of any developers who install the malicious packages, whether through typosquatting, social engineering, or dependency confusion. The use of packages with utility-sounding names (cdn-img-fetch, img-to-native, native-runner, runhelper, imgdecode) suggests attempts to appear legitimate to developers seeking image processing or runtime helper functionality.

Historical Context

MALFEX has been active since August 6, 2023, representing a sustained three-year campaign against the npm ecosystem. The campaign was first documented by Checkmarx and CloudSEK before the imgdecode discovery by SafeDep in October 2026. Historical analysis reveals three distinct infection pathways: Overlord RAT loaders (three packages), Node.js stealer chains (cdn-img-fetch, img-to-native, native-runner), and postinstall hook-based downloaders. The September-October 2026 timeline demonstrates the actor's resilience: when npm removed native-runner and img-to-native on September 28, the actor published replacements (imgbundle, runhelper) within 48 hours. After runhelper was unpublished, imgdecode appeared six hours later with enhanced capabilities. This pattern of rapid iteration—from packages requiring multiple dependencies (versions 1.0.0-1.0.2) to standalone operation (version 1.0.3)—shows technical evolution in response to defensive actions. The consistent use of encryption keys containing "malfex" branding and infrastructure reuse (104.234.65[.]75, cavecrew GitHub account) across multiple package generations indicates a single persistent actor rather than copycat activity.

Defensive Recommendations

  • Implement npm package vetting processes that flag packages with native addons (DLLs) and inspect compiled binaries before installation, particularly from new or low-reputation publishers
  • Monitor for T1055 process injection into dllhost.exe from Node.js processes using EDR telemetry and Windows Sysmon Event ID 8 (CreateRemoteThread) and Event ID 10 (ProcessAccess)
  • Block network connections from Node.js processes to known MALFEX infrastructure (104.234.65[.]75 on ports 700 and 7007) and implement egress filtering for developer workstations accessing GitHub repositories during package installation
  • Detect T1027 obfuscation by scanning for encrypted payloads embedded in image files (JPG/PNG) within node_modules directories and flag packages downloading content from GitHub repositories post-installation
  • Enable T1497 sandbox evasion detection by monitoring for anti-analysis checks targeting VM artifacts, Process Monitor, and Wireshark, and implement application whitelisting to prevent execution of binaries written to %APPDATA%\Microsoft\Windows\ by Node.js processes