A malicious npm package called imgdecode hides malware inside image files hosted on GitHub. Security researchers at SafeDep discovered the package as part of the MALFEX campaign, which has targeted Windows developers since August 2023. In total, the campaign spans eight malicious npm packages with over 40,000 combined downloads. Of those, a single package called function-flag accounts for over 37,000 downloads alone.
The imgdecode package contains a nine-line JavaScript file that loads a Windows DLL. Once loaded, the DLL downloads an encrypted payload disguised as a JPEG from a GitHub repository. It then decrypts the payload and injects shellcode into the Windows dllhost.exe process. As a result, the malware runs silently without triggering standard security alerts.
The timeline of events is as follows:
- September 26, 2026 – cdn-img-fetch, img-to-native, and native-runner 1.0.0 published
- September 28, 2026, at 4:06 p.m. UTC – npm removes native-runner and img-to-native
- September 30, 2026, at 3:29 a.m. UTC – imgbundle 1.0.0 published, replacing img-to-native
- September 30, 2026, at 3:37 a.m. UTC – runhelper 1.0.0 published, replacing native-runner
- September 30, 2026, at 4:13 p.m. UTC – runhelper unpublished
- September 30, 2026, at 10:32 p.m. UTC – imgdecode 1.0.0 published
- September 30, 2026, at 11:07 p.m. UTC – imgdecode 1.0.1 published
- October 1, 2026, at 5:48 p.m. UTC – imgdecode 1.0.2 published
- October 7, 2026, at 11:06 p.m. UTC – npm removes imgbundle
- October 8, 2026, at 1:03 p.m. UTC – npm removes cdn-img-fetch
- October 11, 2026, at 10:09 p.m. UTC – imgdecode 1.0.3 published
“After decryption, the DLL checks the first bytes of the plaintext,” SafeDep explained. “If they match a JPEG or PNG signature, the DLL stops. Inference: the operator could turn the loader off by serving encrypted content that decrypts to an image. Serving an ordinary image would instead generally cause decryption to fail before this check.”
Furthermore, the campaign delivers two distinct malware families to infected systems. The first is a Node.js stealer called movinlike that harvests data from Chromium browsers, Discord, Telegram, and cryptocurrency wallets. In addition, it targets seed phrases and sensitive files like .env and .pem. The second is the Overlord RAT, an open-source remote access tool that uses Go.
Meanwhile, the threat actor behind MALFEX has shown persistence in maintaining the campaign. According to researchers at Checkmarx and CloudSEK, npm removed several packages, but the operator published replacements within days. For example, imgbundle replaced img-to-native, and runhelper replaced native-runner. Therefore, imgdecode represents the latest iteration of this ongoing supply chain attack.
Notably, the malware establishes persistence through a Windows Registry Run key and a scheduled task. Also, the stealer opens a WebSocket connection to a command-and-control server for remote access. Consequently, researchers recommend treating any Windows system that installed these packages as potentially compromised. They also advise rotating credentials and moving cryptocurrency funds to new wallets immediately.
