A new malicious npm package has been discovered by cybersecurity researchers as part of the recently revealed software supply chain attack known as MALFEX.
The package, named “imgdecode,” was uploaded to the npm package registry on September 30, 2026, by a user named “malfexteste8.” It has already been downloaded 979 times and is still available on npm. The latest version of the package is 1.0.3.
According to SafeDep, the npm package imgdecode contains a hidden malicious loader in a compiled Node.js addon. When a Node.js program calls require(‘imgdecode’) from a Windows console, the DLL within the package attempts to download encrypted shellcode from GitHub, decrypts it, and injects it into a new dllhost.exe process.
MALFEX is the name given to a long-running campaign where an unidentified threat actor has been publishing malicious packages on npm since August 6, 2023, with the goal of compromising Windows systems. The malicious packages were published under various npm publisher handles such as malfexkkj, malfex_user, malfexteste2, malfexteste3, and malfexteste4.
The campaign involves several malicious packages, with some acting as loaders for the Overlord RAT and others working together to download and run a Node.js stealer. Another infection pathway includes using a postinstall hook to execute JavaScript that contacts an external server to retrieve a next-stage binary.
The threat actor behind the campaign has been responding to public disclosures and npm removals by publishing replacements for the removed packages. The timeline of events shows the continuous efforts to maintain the malicious campaign.
The Node.js stealer chain operates without using an install hook. Instead, the malicious code runs when a specific package is loaded, initiating a series of actions to compromise the system.
Each of the malicious packages in the campaign serves a specific purpose, such as downloading encrypted files, decrypting them, and executing malicious code on the compromised system.
Developers who have installed any of these malicious packages should take immediate action to secure their systems, isolate them, check for any signs of compromise, and take necessary steps to mitigate the impact of the attack.
