Researchers detail how imgdecode npm package hides Windows shellcode

On September 30, 2026, the npm account malfexteste8 published the imgdecode package. SafeDep reported that imgdecode contains a malicious loader inside a compiled Node.js addon.

The imgdecode package includes a nine‑line JavaScript file that loads a Windows dynamic-link library. Invoking require(‘imgdecode’) on a Windows system leads the DLL to attempt downloading encrypted shellcode from a GitHub repository. After downloading, the DLL decrypts the shellcode and injects it into a dllhost.exe process. The imgdecode addon, a 64-bit MSVC DLL, first checks if it runs in a developer terminal.

The DLL fetches banner.jpg from the cavecrew/proj repository, decrypts the embedded payload using the key nif‑runtime‑2027 and injects the result into dllhost.exe. After decryption, the DLL examines the first bytes of the plaintext; if they resemble a JPEG or PNG signature, it halts execution. SafeDep noted that the operator could prevent the loader by supplying encrypted data that results in an image, whereas an ordinary image would lead to decryption failure ahead of this check. A screenshot from the Internet Archive dated October 6, 2026 indicates that the image file matches the Go‑based downloader that retrieves the Node.js stealer and remote access tool movinlike from 104.234.65[.]75:700.

In the Node.js application, a.env file stores a command-and-control (C2) address (104.234.65[.]75:7007) together with a MALFEX license key, indicating a malware builder or licensing setup. It can establish a WebSocket link to the C2 server to receive commands for shell execution, file transfers, process control, clipboard use, screen captures and mouse‑keyboard actions. Starting with imgdecode version 1.0.1, the DLL also fetches and decrypts the payload. Imgdecode releases 1.0.1 and 1.0.2 continue to invoke require(‘imgbundle’) before loading the DLL.

Imgdecode version 1.0.3 removes the imgbundle dependency and functions without any additional MALFEX package. Imgdecode version 1.0.0 waits until the imgbundle package creates a file in the cdn‑img‑fetch/.runtime/ directory before handing its contents to a native Node.js addon for decoding. Imgdecode version 1.0.0 was released on September 30, 2026 at 10:32 p.m. UTC. Imgdecode version 1.0.2 was published at 5:48 p.m. UTC on October 1, 2026.

The most recent version of imgdecode available on the npm registry is 1.0.3. As of October 17, 2026, the package had been downloaded 979 times and remained available for installation. SafeDep stated that imgdecode hides a malicious loader within a compiled Node.js addon. The threat actor used five distinct npm publisher handles: malfexkkj, malfex_user, malfexteste2, malfexteste3 and malfexteste4.

Checkmarx and CloudSEK first recorded the MALFEX campaign, noting it has operated since August 6, 2023. By October 2026, the campaign had resulted in more than 40,000 malicious npm downloads and involved twelve packages, eight of them malicious. Checkmarx determined that no legitimate or widely used npm package relies on any operator package, limiting exposure to systems that installed those names directly and showing no geographic or organizational focus.

Checkmarx outlined three separate delivery routes in the MALFEX campaign, noting they use no shared infrastructure yet tie to the same threat actor. The first route distributes Overlord RAT loaders and obfuscated scripts during npm install, functioning solely on Windows systems. The second route installs the Node.js stealer movinlike when a package loads, targeting eight Discord clients, seven common browsers and cryptocurrency wallets for data exfiltration. The third route employs a distinct downloader in each malicious variant of function‑flag to obtain a payload from a different location and also runs a postinstall script that contacts an external server for an unspecified next‑stage binary.

Overlord RAT delivers functions including screen capture, keylogging, monitoring of windows, remote shell access, file searching and a concealed desktop. The MALFEX infection chain does not rely on install hooks; instead, executing the native‑runner package triggers the malicious code. Checkmarx observes that the infection routine allows package installation to complete even when the payload download fails, remaining silent on macOS and Linux and affecting only Windows systems. To maintain persistence, the malware creates a Registry Run key and a scheduled task called MicrosoftEdgeUpdateService, then conducts anti‑analysis checks targeting virtual machines, sandboxes and Process Monitor; it also scans for Wireshark before collecting files like.kdbx,.pem,.ppk,.env and browser data from Chromium‑based browsers, as well as data from Discord, Telegram, cryptocurrency wallets and gaming platforms such as Steam, Epic Games, Riot, Battle.net, Minecraft, plus Ubisoft.

Among the eight MALFEX packages identified, three function as loaders for the Overlord RAT. The MALFEX packages cdn-img-fetch, img-to-native and native-runner combine to download and execute a Node.js stealer.

Following the removal of native-runner and img-to-native from the npm registry on September 28, 2026, the threat actor released the replacement packages runhelper and imgbundle on September 30, 2026. The native-runner package depends on img-to-native, and the img-to-native package lists itself as a dependency. The cdn-img-fetch package retrieves banner.png from the cavecrew/proj repository and extracts an encrypted binary blob from it. The img-to-native package decodes that blob with the key malfexteam2027 and writes the result to %APPDATA%\Microsoft\Windows\node_runtime_helper.exe as a Go executable.

The native-runner package executes the Go executable, which then downloads the stealer binary setup.exe (also known as movinlike) from 104.234.65[.]75:700. The runhelper package functions as a helper utility for launching native binaries from Node.js projects and operates similarly to native-runner. Its primary role is to locate the JPG file storages at cdn-img-fetch/.runtime/rt.jpg, extract the shellcode, copy it into executable memory and run it via the Koffi FFI module. Six hours after runhelper was taken offline, the operator published imgdecode containing a compiled DLL meant to run shellcode.

As of October 1, 2026, the malicious packages function-flag, function-color and cdn-img-fetch were still available for installation on the npm registry. The function-flag package has been malicious since July 2025, has recorded more than 37,000 downloads, and no OSV advisory marks it as malicious. OSV advisories have been issued for the malicious packages tlxbnhd, tldriver, mxdriver, img-to-native, native-runner and cdn-img-fetch.

The OSV advisory for cdn-img-fetch addresses only two of its four malicious versions. Anyone who installed any of those packages should treat their Windows machines as potentially compromised, isolate them, look for persistence mechanisms, rotate login credentials and move funds to new wallets if seed phrases were saved.