Key points
- The imgdecode package was uploaded on September 30, 2026, by user malfexteste8.
- It has been downloaded 979 times and remains available on the npm registry.
- The package loads a Windows DLL that retrieves encrypted shellcode from GitHub.
Cybersecurity researchers identified the imgdecode npm package as part of the MALFEX supply chain attack campaign. The package was uploaded to the registry on September 30, 2026, by an account named malfexteste8. It is currently available for download and has been retrieved 979 times according to The Hacker News.
The latest version of the package is 1.0.3. SafeDep reported that the package hides a malicious loader inside a compiled Node.js addon. A nine-line JavaScript file loads a Windows dynamic-link library. When a program calls require('imgdecode') on a Windows console, the DLL attempts to download encrypted shellcode from GitHub.
Campaign Context and Evolution
Checkmarx and CloudSEK first documented the MALFEX campaign, which has targeted Windows systems since August 6, 2023. The threat actor published malicious packages across five npm handles, including malfexkkj and malfexteste2. Three of eight identified packages acted as loaders for the Overlord RAT. Three others worked together to run a Node.js stealer.
The actor appears to respond quickly to public disclosures and registry removals. After npm removed native-runner and img-to-native on September 28, 2026, the actor published replacements named runhelper and imgbundle within two days. The first version of imgdecode was published on September 30, 2026, the same day as those replacements.
Affected Environments and Versions
This activity specifically targets Windows systems running Node.js applications. The imgdecode package requires a Windows console to execute its payload. The DLL injects the decrypted shellcode result into a new dllhost.exe process. The package versions 1.0.0 and 1.0.1 were published on September 30, 2026. Version 1.0.3 is the latest reported iteration.
Next steps
No fix has been confirmed yet for this specific package. The package remains available on npm as of writing. Teams should verify if any internal projects depend on imgdecode or related MALFEX packages like runhelper. The actor may publish further replacements if current packages are removed from the registry.
Signals worth monitoring
Teams usually detect this activity by monitoring outbound connections from Node.js processes to unexpected GitHub endpoints. Check whether dllhost.exe processes are spawning with unusual command-line arguments or parent processes. Look for dynamic-link libraries being loaded by JavaScript modules that do not explicitly require native bindings. Review package installation logs for recently added dependencies with low download counts or new publisher accounts.
Background: Threat actors
Threat actors range from criminal syndicates seeking profit to state-sponsored groups aiming for espionage. Each type uses distinct tactics, techniques and procedures (TTPs) driven by their goals. Knowing the difference helps you prioritize alerts and allocate security resources where they matter most.
Read the full guide: Types of Threat Actors: Motives, Methods, and Defense Strategies
What to do and how to stay safe: npm
- Audit installed npm packages for any dependency on imgdecode or known MALFEX variants such as runhelper.
- Monitor network traffic for Node.js processes attempting to connect to GitHub repositories not in your approved list.
- Restrict the ability of development environments to execute native addons or DLLs without explicit verification.
- Once the vendor provides an update, apply it immediately and verify the integrity of the package signature.
Step-by-step guide: Phishing Defined: Anatomy of the Attack and Risk Reduction
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What does the imgdecode package do?
It loads a Windows DLL that downloads encrypted shellcode from GitHub and injects it into a dllhost.exe process.
Is the imgdecode package still available on npm?
Yes, it is still available on the npm registry as of writing.
Who uploaded the imgdecode package?
The package was uploaded by a user named malfexteste8 on September 30, 2026.
