Recent findings by cybersecurity experts have uncovered a harmful npm package named ‘imgdecode’ as part of a software supply chain attack, known as MALFEX. The package was uploaded to npm on September 30, 2026, by a user under the alias ‘malfexteste8’. As of now, it has been downloaded 979 times and remains available on the npm registry. The package’s latest iteration is version 1.0.3.
Details of the Malicious Package
The ‘imgdecode’ npm package conceals a harmful loader within a compiled Node.js addon, according to reports from SafeDep. This addon utilizes a Windows DLL to download encrypted shellcode from GitHub. Once decrypted, the code is injected into a new dllhost.exe process. The package is a component of a longer-running campaign, first identified by Checkmarx and CloudSEK as MALFEX, which targets Windows systems through npm packages.
Timeline and Response
The campaign began on August 6, 2023, with malicious packages being published under various npm handles. The ‘imgdecode’ package was introduced after npm removed several related packages. Despite efforts to curb the attack, replacements for removed packages appeared swiftly, highlighting the threat actor’s adaptability. Key events include the publication and removal of several npm packages, with ‘imgdecode’ emerging as a significant threat.
Functionality and Impact
The npm packages linked to MALFEX operate without an install hook, executing malicious code when certain packages are loaded. For instance, ‘native-runner’ executes a Go executable that downloads a stealer binary. Another package, ‘runhelper’, functions similarly, running malicious code by extracting shellcode from specific files. These packages aim to compromise systems by bypassing conventional security measures.
The malicious activity isn’t limited to software execution. The malware checks for security tools, gathers sensitive data from browsers and applications, and can establish a WebSocket connection to a command-and-control server. This allows it to execute various commands, enhancing its impact on the compromised system.
Protective Measures and Recommendations
Developers using these packages should consider their systems compromised. Immediate actions include isolating affected systems, removing persistence mechanisms, rotating credentials, and securing cryptocurrency wallets. Proactive measures are essential to mitigate further risks and ensure system integrity.
As this incident underscores the vulnerabilities in software supply chains, it’s crucial for developers and organizations to remain vigilant. Continuous monitoring and timely updates are vital in defending against such sophisticated cyber threats.
