Key points
- The malicious package imgdecode was uploaded by user malfexteste8 on September 30, 2026, and remains available on the registry.
- SafeDep reports the nine-line JavaScript file loads a Windows DLL that downloads and decrypts shellcode from GitHub.
- This incident is part of the long-running MALFEX campaign, which has published multiple malicious packages since August 2023.
Cybersecurity researchers have identified a new component in the MALFEX software supply chain attack campaign, targeting Windows environments through the npm registry. According to The Hacker News, the malicious package named imgdecode was published by the account malfexteste8. The latest version, 1.0.3, is still hosted on the platform. Organizations managing Node.js dependencies must verify if their systems have pulled this specific package, as it introduces a direct execution pathway for remote code within standard development workflows.
By the numbers
- 979 total downloads recorded for the imgdecode package as of the report's publication.
- 8 distinct malicious packages identified in the broader MALFEX campaign since August 2023.
- 2 days elapsed between npm removing previous malicious packages and the publication of replacements.
What the figures mean
The persistence of the MALFEX campaign indicates an adaptive threat actor responding to registry removals with rapid replacements. According to SafeDep, the imgdecode package hides a loader within a compiled Node.js addon. When a Node.js program executes require('imgdecode') on Windows, the associated DLL attempts to fetch encrypted shellcode from GitHub. The payload then decrypts this data and injects it into a new dllhost.exe process. The campaign previously used packages like cdn-img-fetch and native-runner to deploy Overlord RAT or Node.js stealers. The threat actor appears to be responding to public disclosures by publishing replacements for removed packages within two days.
Operational impact
Security teams usually need to audit internal npm registries for packages published by unknown or suspicious handles. Check whether any development pipelines automatically install dependencies without verification. Inform your software development and infrastructure groups about the risk of post-install hooks in native addons. Ensure that incident response plans include steps for isolating systems that execute untrusted Node.js modules. Verify that monitoring tools can detect outbound connections from development environments to unexpected cloud storage domains.
Background: Incident response plans
Incident response plans fail when teams assume they cover every attack vector or treat them as static documents. You must focus on decision trees, not scripts. Plan for communication breakdowns, not just technical fixes. Regular table-top exercises reveal gaps that documentation hides.
Read the full guide: Fix Incident Response Plans That Fail Under Pressure
What to do and how to stay safe
- Audit your internal npm repository to block or remove any packages published by the user malfexteste8 or other known MALFEX handles.
- Review Node.js application dependencies for the imgdecode package and remove it if found in any production or development environment.
- Monitor network traffic for outbound connections to GitHub from development servers that do not normally require such access.
- Inspect running processes for unusual dllhost.exe instances spawned by Node.js applications, which may indicate shellcode injection.
Step-by-step guide: Security Awareness Training: What It Is and How It Works
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which npm package is currently identified as part of the MALFEX campaign?
The package named imgdecode, specifically version 1
