Threat Intelligence

MALFEX Campaign Strikes Again: Fake npm Package 'imgdecode' Hides Windows Malware Loader

The Hacker News · 17 Oct 2026

Key Takeaway Before adding any npm package to your projects, check its publisher and download history, and avoid installing unfamiliar packages on Windows machines that hold business credentials.

Security researchers have identified another malicious package tied to MALFEX, a software supply chain campaign that has targeted Windows systems through the npm package registry. The package, called "imgdecode", was uploaded on September 30, 2026, by a user named "malfexteste8". It has been downloaded 979 times and was still available on npm at the time of writing. Its latest version is 1.0.3.

According to SafeDep, imgdecode hides its malicious loader inside a compiled Node.js addon. A short JavaScript file loads a Windows DLL. When a Node.js program calls the package from a Windows console, the DLL attempts to download encrypted shellcode from GitHub, decrypts it, and injects the result into a new dllhost.exe process.

MALFEX was first documented by Checkmarx and CloudSEK. An unknown threat actor has been publishing malicious npm packages since August 6, 2023, across five publisher handles. Of eight identified packages, three load Overlord RAT, and three others work together to download and run a Node.js stealer. Another pathway uses a postinstall hook to fetch a further binary from an external server. The attacker also appears to respond to public disclosures and npm removals: replacements for two removed packages were published within two days, and imgdecode's first version appeared the same day.

npm supply chain attack MALFEX Windows malware Node.js

Summarised by CISO AI from The Hacker News, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.