MALFEX hides a shellcode loader inside an npm native addon that is still live
On October 17, 2026, SafeDep, Checkmarx and CloudSEK document the MALFEX campaign, which has been publishing npm packages since August 2023 whose nine-line JavaScript files load a DLL that injects shellcode into a Windows process. If your Windows machines install npm dependencies with native addons, audit your dependency trees and treat affected hosts as compromised.
September 30, 2026. The npm package imgdecode is published under the account malfexteste8. October 7, 2026. Version 1.0.2 ships, still available on the registry. October 17, 2026. SafeDep, Checkmarx and CloudSEK document the MALFEX campaign, active since August 6, 2023 and aimed at Windows machines. Why it matters: a nine-line JavaScript file is enough to load a DLL that downloads, decrypts and injects shellcode into a dllhost.exe process — well out of reach of any source review.
A nine-line loader that sidesteps code review
What makes imgdecode unusual is that it hides nothing in its JavaScript. The file is nearly empty: nine lines that, per SafeDep, do nothing but load a Windows DLL. “The npm package imgdecode hides a malicious loader in a compiled Node.js addon,” the vendor summarizes. “When a Node.js program calls require("imgdecode") from a Windows console, the DLL attempts to download encrypted shellcode from GitHub, decrypts it and injects the result into a new dllhost.exe process.”
This is the blind spot the campaign exploits. An npm package is normally read as source code: you can audit the JavaScript files before you ship them. A native addon, by contrast, is a binary — a .node file compiled in C or C++ — either bundled or built at install time via node-gyp. The malicious logic lives in the binary, not in the text. A conventional dependency review, the kind that reads diffs and sources, sees nothing.
A three-stage chain, rewritten after every takedown
MALFEX is not a single package but a long-running campaign. Since August 2023, the operator has published eight packages across five npm handles (malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4). Three of them load the Overlord RAT; three others — cdn-img-fetch, img-to-native and native-runner — form a data-stealing chain.
The mechanics of that chain are documented:
- cdn-img-fetch downloads a
banner.pngfrom the GitHub repository cavecrew/proj and extracts an encrypted blob. - img-to-native decrypts the blob with the key malfexteam2027 and writes a Go executable (
node_runtime_helper.exe) into%APPDATA%. - native-runner runs that binary, which downloads the stealer (
setup.exe, aka movinlike) from 104.234.65[.]75:700.
imgdecode is the latest iteration, the one that drops the JavaScript chain in favor of a single binary. Version 1.0.0 still waited for imgbundle to drop a file, then handed its contents to the native addon for decoding. From 1.0.1 onward, the DLL — a 64-bit binary compiled with Microsoft Visual C++ — fetches banner.jpg from cavecrew/proj itself, decrypts the payload with the key nif-runtime-2027 and injects it into dllhost.exe. Version 1.0.3, published on October 11, 2026, removes the last external dependency: the package is fully self-contained.
An operator that responds to takedowns within hours
The timeline published by SafeDep shows an adversary watching the registry around the clock. On September 28, 2026 at 4:06 p.m. UTC, npm removes native-runner and img-to-native. On September 30 at 3:29 a.m., the operator publishes imgbundle to replace img-to-native, then runhelper at 3:37 a.m. to replace native-runner — a gap of roughly two days between removal and replacement.
runhelper is telling of the technical drift: instead of a chain of packages, it locates an rt.jpg file, extracts shellcode from it, copies it into executable memory and runs it through Koffi, an FFI module for Node.js. Six hours after it was unpublished, imgdecode appeared with the compiled DLL — the most autonomous version of the campaign yet.
Another sign of industrial tooling: the .env file embedded in the payload contains a command-and-control address (104.234.65[.]75:7007) and a MALFEX license key, pointing to the use of a malware builder or a licensing system to produce payloads on demand.
What the final payload steals
Once the shellcode is injected, the stealer runs anti-analysis checks: it detects virtual machines, sandboxes and tools such as Process Monitor or Wireshark. It then harvests files matching seed phrases and certain extensions (.kdbx, .pem, .ppk, .env), along with data from Chromium-based browsers, Discord, Telegram, cryptocurrency wallets and gaming platforms (Steam, Epic Games, Riot, Battle.net, Minecraft, Ubisoft).
The payload opens a WebSocket connection to the command server, which accepts orders for shell execution, file transfer, process control, clipboard access, screenshots and mouse-and-keyboard input. For persistence, it adds a Run registry key and creates a scheduled task named MicrosoftEdgeUpdateService.
Why the registry cannot stop it
The operator’s responsiveness points to a structural limit of the npm model. A package removal is reactive: it follows a publication, it does not prevent one. An adversary watching its own packages can republish a replacement within hours, under a new name, with a slightly modified binary. The payload does not get easier to detect — it simply changes its label.
Add to this the absence of a CVE: without a vulnerability identifier, npm audit and most dependency scanners stay silent. And unlike typosquatting, which tricks you on the name, imgdecode presents itself as a legitimate image utility that developers install willingly. The “trust the name” filter does not apply: the package was downloaded 979 times in a matter of weeks, with no vulnerability score lighting up. The presence of a MALFEX license key in the payload points to assembly-line production, able to absorb a takedown as a mere operating cost.
What to check right now
The practical risk concentrates on Windows development machines: imgdecode had been downloaded 979 times at the time of analysis and remains on npm. The fact that the payload only activates from a Windows console — the DLL first checks it is running in a developer terminal — targets precisely the hosts that install dependencies.
Here are the actions to take without delay:
- Inventory your
package-lock.jsonandnode_modulesfor the names imgdecode, imgbundle, cdn-img-fetch, img-to-native, native-runner and runhelper. - Isolate any Windows machine where one of these packages appeared, then look for the
MicrosoftEdgeUpdateServicetask and its associated Run key. - Rotate credentials and move funds to fresh wallets if seed phrases may have been stored on those hosts.
The deeper trap is that npm audit will flag nothing: there is no published CVE, only packages whose source code is benign and whose malice lives in the binary. Detection therefore runs through an inventory of native addons and unusual dependencies, not through vulnerability scores.
One detail is worth underlining: the detonation gate. The DLL checks whether it is running in a developer terminal before doing anything; on a headless CI runner, a build container or an isolated sandbox, it stays inert. That makes the infection effectively invisible to the environments where you would most expect to catch it — automated scanners, sandboxes and npm audit — and pushes it onto the interactive workstations where a human is logged in.
Verdict
If your developers install npm packages on Windows hosts, treat native addons as untrusted binaries: pin versions, require review of compiled dependencies, and run installs in disposable environments. If you run Linux or macOS only, the direct risk from this payload is low — it targets Windows — but the lesson is general: a package that loads compiled code bypasses source review, and that is exactly what supply-chain campaigns like MALFEX have been exploiting for over three years.