MALFEX researchers uncovered a malicious npm package named imgdecode, part of a broader supply chain campaign tracked as MALFEX. The package, uploaded on 30 September 2026 by user malfexteste8 and currently at version 1.0.3, hides a loader in a compiled Windows Node[.]js addon. When a Node[.]js program executes require('imgdecode') on Windows, a DLL loaded by the addon downloads encrypted shellcode from GitHub, decrypts it, and injects the result into a new dllhost[.]exe process.
This loader is coordinated with three other malicious packages—cdn-img-fetch, img-to-native and native-runner—that together download and execute a Go-based stealer, with a postinstall hook in some variants enabling an additional next-stage binary fetch. The operation uses a Go executable written to %APPDATA%\Microsoft\Windows\node_runtime_helper.exe and contacts a C2 address (104.234.65[.]75:7007) for command-and-control.
The MALFEX chain is notable for its lack of install hooks; instead, it activates when native-runner is loaded, with imgbundle and imgdecode forming dependencies in earlier versions. Evidence includes a published timeline showing npm removals (native-runner, img-to-native) on 28 September 2026 and subsequent fresh payloads (imgdecode 1.0.0, then 1.0.1–1.0.3) published on 30 September and 1–11 October 2026.
The malware is described as capable of extracting and exfiltrating data from Chromium-based browsers, crypto wallets, and popular apps, establishing a WebSocket C2 channel, and offering shell, file, and clipboard capabilities, with persistence via a Run key and a scheduled task. Users who installed any of these packages should treat affected Windows systems as compromised, isolate them, rotate credentials, and secure wallets if seed data was present.