Fast Facts
- Malicious npm packages like "imgdecode" and related tools exploit Node.js environments to deploy malware, including remote access tools, stealers, and loader components that inject malicious code into Windows systems.
- Attackers rapidly adapt by replacing removed or flagged packages with new variants (e.g., "runhelper," "imgbundle") to maintain command-and-control and avoid detection.
- The malware chain exfiltrates sensitive data such as credentials, crypto wallets, and browser info, and enables remote control of infected systems through C2 channels, with persistence mechanisms like registry keys and scheduled tasks.
Threat Overview, Attack Techniques, and Targets
Cybersecurity researchers found a malicious npm package called “imgdecode” linked to the MALFEX campaign. The attack started when the package was uploaded on September 30, 2026, by the user “malfexteste8.” This package has been downloaded nearly 1,000 times and remains available. The threat actor uses a cunning method of hiding malicious code in a compiled Windows DLL within the npm package. When a Node.js program runs and calls “require(‘imgdecode’)”, the DLL downloads encrypted shellcode from GitHub. It then decrypts this code and injects it into a process called “dllhost.exe.”
This campaign is part of a long-running effort by an unknown actor. Since August 6, 2023, the attacker has published multiple malicious npm packages intended to target Windows systems. Among these are packages that deploy remote access tools like Overlord RAT and steal data from infected systems. The attacker also used a chain of packages to download malware and carry out further malicious actions. They responded quickly to npm removals by replacing and re-publishing similar packages, which shows their adaptability.
The attack mainly targets systems running Windows that use Node.js. Developers who include these malicious packages in their projects are at risk. The campaign also involves complex techniques like decrypting payloads, injecting shellcode, and downloading additional malicious payloads from GitHub. The threat actor’s goal appears to be gaining control of infected computers to steal data or deploy remote access tools.
Impact, Security Implications, and Remediation Guidance
This campaign can lead to serious consequences. If infected, systems may allow attackers to execute commands remotely, steal sensitive data, or install additional malware. The attack techniques used—such as DLL injection, encrypted payloads, and persistent infection methods—make detection and removal difficult. The campaign’s use of multiple malicious packages and obfuscated code indicates a significant security risk.
The infection also affects the integrity of the affected systems. Data theft, unauthorized access, and system compromise are likely outcomes. Additionally, the attacker’s ability to respond quickly to takedown efforts shows that the threat is adaptable and persistent.
As no specific remediation guidance is provided here, organizations should obtain detailed advice from the relevant vendor or cybersecurity authority. In general, affected developers should treat their Windows systems as compromised. It is important to isolate the devices, check for malicious persistence entries, and rotate passwords and credentials. If seed phrases or sensitive data were stored, transfer funds to new wallets. Conduct thorough security scans to detect and remove malicious files. Keep systems and software updated and avoid using suspicious npm packages. The best approach is to consult security experts or vendor advisories for proper incident response and removal procedures.
Stay Ahead with the Latest Tech Trends
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
