# MALFEX Campaign Uses npm Package imgdecode to Inject Windows Shellcode Malicious Node.js addon exploits Windows systems by downloading encrypted shellcode from GitHub repositories. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-10-17 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/37dc0f2a-4e47-4dca-8c1d-7b0755ecf299 ## MALFEX Campaign Overview The MALFEX campaign, active since August 6, 2023, targets Windows systems through malicious npm packages. Threat actors utilize multiple publisher handles to distribute loaders for Overlord RAT and Node.js stealers. Recent activity includes the publication of the imgdecode package, which specifically hides a malicious loader within a compiled Node.js native addon. ## Mechanism of imgdecode Uploaded on September 30, 2026, by user malfexteste8, imgdecode version 1.0.3 functions as a standalone malicious loader. When a Node.js program executes require('imgdecode') on Windows, the package triggers a DLL that fetches encrypted shellcode from GitHub. This payload is decrypted and injected directly into the dllhost.exe process to maintain stealthy execution. ## Evolution of Attack Tactics The threat actor behind MALFEX demonstrates rapid adaptation to security disclosures. After the removal of packages like native-runner and img-to-native, the operator published replacements like runhelper and imgdecode within two days. Version 1.0.3 of imgdecode is particularly notable for removing dependencies on previous MALFEX packages, streamlining the infection process for the attacker. ## Payload Decryption and Control The 64-bit MSVC DLL uses the decryption key nif-runtime-2027 to process payloads fetched from the cavecrew/proj GitHub repository. The loader includes a kill-switch mechanism; if the decrypted content matches a JPEG or PNG signature, the DLL terminates. This allows the operator to disable the malware remotely by serving standard image files instead. ## Advanced Anti-Analysis Features Before harvesting sensitive data, the malware performs rigorous anti-analysis checks to detect virtual machines, sandboxes, and monitoring tools like Wireshark or Process Monitor. It targets specific file extensions including .kdbx, .pem, and .env, while also scraping data from Chromium browsers, Discord, Telegram, and various cryptocurrency wallets to ensure maximum impact on compromised systems. ## Persistence and C2 Capabilities Once established, the malware achieves persistence by adding a Registry Run key and creating a scheduled task titled MicrosoftEdgeUpdateService. It maintains a WebSocket connection to a command-and-control server at 104.234.65.75:7007. This allows the attacker to execute shell commands, transfer files, capture screenshots, and log keyboard or mouse input from the victim. ## Licensing and Infrastructure The presence of a .env file containing a MALFEX license key suggests the use of a sophisticated malware builder or licensing system. The infrastructure relies on GitHub repositories and specific IP addresses to distribute the Node.js stealer and remote access tools. This indicates a structured, long-term operation designed for scalable system compromise. ## Remediation for Affected Developers Developers who installed imgdecode or related packages must treat their Windows environments as fully compromised. Immediate actions include isolating affected machines, rotating all stored credentials, and transferring funds from any wallets containing stored seed phrases. Checking for persistence entries and scheduled tasks is critical to ensure the complete removal of the threat. ## Sources covering this story - https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._