Key points
- The imgdecode npm package (v1.0.3) contains a hidden loader that downloads encrypted shellcode from GitHub.
- Uploaded on September 30, 2026, the package has been downloaded 979 times and remains available on the registry.
- This is part of the broader MALFEX campaign, which has targeted Windows systems since August 2023 using multiple handles.
The npm package named imgdecode, currently at version 1.0.3, is part of a supply chain attack. According to The Hacker News, this package hides a malicious loader inside a compiled native addon. When a program calls require('imgdecode') on a Windows console, the code loads a dynamic-link library that attempts to download encrypted shellcode from GitHub. The library then decrypts the response and injects it into a new dllhost.exe process. The package is still available on npm as of the report.
In plain English
The imgdecode package looks like a standard image decoding tool, but it contains hidden malicious code. SafeDep noted that its nine-line JavaScript file loads a Windows DLL. This DLL acts as a loader, reaching out to GitHub to fetch encrypted instructions. Once downloaded, the code decrypts these instructions and forces them into a legitimate system process called dllhost.exe. This mechanism allows the execution of the downloaded shellcode within the context of that new process.
The background
This package is part of a long-running supply chain attack campaign dubbed MALFEX. First documented by Checkmarx and CloudSEK, the campaign involves an unknown threat actor publishing malicious packages to npm since August 6, 2023. The actor has used five npm publisher handles, including malfexkkj and malfexteste8. Previous packages in this campaign delivered the Overlord RAT or Node.js stealers. The actor appears responsive to public disclosures, quickly replacing removed packages like native-runner with new variants such as runhelper and imgbundle before publishing imgdecode.
What changes now
The imgdecode package was uploaded on September 30, 2026, and reached version 1.0.1 by that same day. As of the report, it remains available on the npm registry. The campaign shows a pattern of rapid iteration; after npm removed native-runner and img-to-native on September 28, replacements appeared within two days. This suggests the threat actor is actively maintaining these distribution channels. Small-business owners must assume that any recent npm installs from these handles or similar names are compromised.
Who needs to act first
Teams should prioritize auditing systems that run Node.js applications on Windows. Check whether any development or production environments have installed the imgdecode package or its predecessors. If found, isolate those systems immediately to prevent lateral movement. Review dependency logs for any packages installed from the malfexteste8 handle or related accounts. Ensure that build processes do not automatically trust new dependencies without verification. Roll out any vendor-provided updates cautiously, testing them in a staging environment first to avoid breaking critical applications.
What to do and how to stay safe: npm
- Audit your npm package lists for imgdecode and uninstall it immediately if present.
- Check for other packages from the malfexteste8 handle or similar variants like runhelper.
- Monitor Windows processes for unexpected dllhost.exe activity or connections to GitHub.
- Wait for the vendor to provide an official update or removal notice before re-trusting the registry.
Step-by-step guide: Phishing Risks and Protection for Small Business Operations
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is the imgdecode package still available for download?
Yes, according to The Hacker News, the package is still available on npm as of the report's writing.
What does the malicious code do once installed?
It downloads encrypted shellcode from GitHub, decrypts it, and injects it into a new dllhost.exe process.
How many times has this specific package been downloaded?
The imgdecode package has been downloaded 979 times as of the report's publication.
