Researchers detect Npm Imgdecode package linked to MALFEX that attacks Windows

Security researchers have identified a malicious package published in the npm record that is part of a supply chain campaign aimed at Windows and nicknamed MALFEX. The package, called imgdecode, appeared on npm on September 30, 2026 under the user "malfexteste8," has the most recent version 1.0.3 and, according to the available data, had been downloaded 979 times at the time of the finding. Research groups such as Checkmark and CloudSEK have documented different parts of this campaign; in addition, SafeDep's technical analysis describes how the package incorporates a native charger that ends up running malicious code on Windows machines.

The facts confirmed by security firms are as follows: imgdecode contains a small JavaScript facade that loads a native complement (a Node.js addon compiled as DLL from MSVC). This native component downloads an encrypted blob from a GitHub repository associated with the user "cavecrew," disfigures it and, if the decrypt content is not simply an image, it injects it into a legitimate Windows process (dllhost.exe). Previous versions of the campaign used several chained dependencies - cdn-img-fitch, img-to-native, native-runner and its replacements - to obtain, decipher and run native binaries (an executable Go and a stealer / RAT known as "movinlike"). The basic technical details and chronology were published by researchers and are available through the safety reports and the entry of the package in npm; for general references you can see the Checkmark page and the analysis of CloudSEK.

How the MALFEX chain operates technically: the initial vector is a npm package that, when required by a Node.js application in Windows, invokes native code. This native code checks the environment (looking for developer terminals or analysis environments), downloads a JPG / PNG image containing encrypted data, disnumbers it with a known key within the code ("nif-runtime-2027" or others in previous variants) and examines the first bytes of the result. If the decrypt output appears to be an image, the charger stops - a technique that allows the operator to "turn off" the payload by serving only images -; if not, it interprets the content as shellcode or executable and proceeds to inject it into a Windows process to run the payload with sigil. Other parts of the campaign did intermediate steps: download an executable Go to% APPDATA%\ Microsoft\ Windows\ node _ runtime _ helper.exe that then downloaded and ran the stealer from a remote server (IP observed: 104.234.65 [.] 75: 700).

The observed final software functionality includes credentials and data theft capabilities (files with extensions such as .kdbx, .pem, .ppk, .env), Chromium browser data extraction, chat applications and game customers, and the ability to receive WebSocket commands to run shell commands, transfer files, control processes and simulate keyboard / mouse inputs. For persistence, the sample adds a Run key to the Register and creates a scheduled task called "MicrosoftEdgeUpdateService." These capabilities and device names were documented by the response teams that analyzed the samples.

What is confirmed and what remains uncertain: it is confirmed that multiple packages were published and that some were already removed by npm after public disclosure; there are also native code samples that download and decrypt content and that inject into Windows processes. It is reasonable and confirmed that the campaign aims to compromise Windows systems that run malicious npm packages. What is not publicly confirmed is the actual scope of commitments in production environments (the number of downloads does not necessarily amount to active facilities or successful executions), the identity of the operator behind MALFEX and whether all the infrastructure observed remains operational or has been dismantled. Also, blocking an observed IP can mitigate some of the traffic, but an attacker's infrastructure can change quickly.

Who's it to? Mainly to developers and Windows environments where npm packages are used without strict validation, especially projects that load native modules or lack integrity control mechanisms. It also affects any user who has installed any of the identified packages (cdn-img-fitch, img-to-native, native-runner, imgbundle, runhelper, imgdecode or others from the same editor), as the execution occurs when the package is required by a Node.js application on Windows.

Practical implications: in compromised systems, credentials, thirst phrases and sensitive files may have been exfiltered; attackers may keep remote access through a RAT, scale side movements or establish persistence for re-infections. For cryptographic key owners or purse holders, the technical recommendation is to consider that being stored phrases in the system may have been compromised: moving funds and regenerating keys is the only safe measure to avoid financial losses.

Immediate and concrete action to be taken by those concerned: (a) isolate the equipment network to avoid further exfiltration or control and control; (b) to identify and uninstall malicious packages (to run in the npm s imgdecode project or to review package-lock.json / yarn.lock and remove suspicious dependencies); (c) to search for native artifacts mentioned (e.g.% APPDATA%\\ Microsoft\ Windows\ node _ runtime _ helper.exe) and persistency entries (to consult the Registry with reg query and HKCU\\ Software\\\ Windows\ RR + RR + s to be reported in the computer, and to be relocated in the computer and to perform the computer's (65.75.75.70.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.60.@@

Recommendations for developers and security equipment: use unit lock (lockfiles), check the dependency chain before updating bookstores (npm audit and SCA tools), restrict the installation of packages containing native binaries without verification, enable allowlist policies in private records and require 2FA for publication accounts. Consider adopting package signature and verification tools such as Sigstore for software artifacts and review native binaries with static / dynamic analysis before use in sensitive environments (more about Sigstore in https: / / sigstore.dev /).

For more context and technical details, see the documentation and publications of the teams that have investigated MALFEX, for example the main pages of Checkmark and CloudSEK, which have followed the campaign and published additional analyses. https: / / checkmarci.com / and https: / / www.cloud. The npm entry for the package is also available to check your status in the register: https: / / www.npmjs.com / package / imgdecode.

In short, the MALFEX threat shows that the npm package supply chain remains a vector for compromising systems, especially when combining transitory units and native modules without controls. Act quickly - isolate, search for artifacts and persistence, rotate credentials and reinstall if appropriate - and strengthen unit verification processes are the concrete measures that will mitigate the immediate risk and reduce the likelihood of reinfections.