October 19, 2026
MALFEX: A Malicious npm Package Hides a Windows Shellcode Loader
What Is MALFEX?
By Ali Ardal
2 min read
What Is MALFEX?
MALFEX is a malware campaign targeting Windows systems through malicious packages in the npm ecosystem. Attackers use packages such as imgdecode to load and execute malicious code through a Windows native addon.
What Happened?
Security researchers discovered that the imgdecode npm package downloads encrypted shellcode through a compiled Windows component, decrypts it, and injects it into the dllhost.exe process. This technique can make the malicious payload more difficult to detect through conventional JavaScript code reviews.
How Does the Attack Work, and How Does It Enter the System?
The MALFEX attack relies on abusing the trust developers place in npm packages used in their projects. Rather than directly exploiting a software vulnerability, attackers use a package that may appear to be a legitimate software component. The recently reported imgdecode package stands out because it moves its malicious loading mechanism from JavaScript into a compiled Windows native addon.
How Does the Attack Chain Work?
1. A Malicious npm Package Enters the Project
When a developer adds the imgdecode package to a project, its malicious component becomes part of the dependency tree. This allows the attack to enter the environment through a software ecosystem the developer may trust.
2. JavaScript Loads the Native Component
The package's JavaScript entry point loads the compiled Windows component, imgdecode.node. A critical detail is that the malicious code does not rely exclusively on a traditional postinstall script. The loader can execute when the application loads the package using require('imgdecode').
3. An Encrypted Payload Is Downloaded
After checking specific Windows console conditions, the native addon attempts to retrieve encrypted data from a GitHub-hosted address. It then attempts to decrypt the data to obtain a payload that can execute in memory. The interactive console check may prevent the behavior from triggering in some automated analysis environments.
4. Shellcode Is Injected Into Another Process
According to the researchers' analysis, the loader attempts to inject shellcode into the Windows dllhost.exe process. This technique can make investigations more difficult by executing malicious code within another process.
5. Potential Data Theft and Remote Access
Payloads associated with the broader MALFEX campaign have been linked to information stealers and remote access trojans (RATs) that may target browser data, session information, developer credentials, and cryptocurrency wallets. However, SafeDep has not conclusively confirmed that the final payload downloaded through imgdecode contains every capability observed in earlier stages of the campaign.
What Makes This Attack Difficult to Detect?
MALFEX stands out because its malicious functionality is concealed within a precompiled Windows component rather than being fully visible in readable JavaScript. Additionally, the loader's reliance on specific console conditions may cause some automated scanning systems to miss its behavior. Therefore, inspecting only postinstall scripts is insufficient; native binaries and runtime process activity must also be examined.
IOCs: Indicators of Compromise
Detecting the MALFEX campaign requires examining malicious npm packages, network connections, and file artifacts on Windows systems. The following indicators have been reported in connection with the campaign.
TypeIndicatornpm packageimgdecode — 1.0.0–1.0.3Related packagesimgbundle, runhelperPublisher accountmalfexteste8GitHub URLraw.githubusercontent[.]com/cavecrew/projIP address104.234.65[.]75Suspicious file%TEMP%\svc_update.exePersistence indicatorMicrosoftEdgeUpdateService
Note: These indicators may relate to different stages of the broader campaign. Verify them against the original research before using them for detection or blocking.
How Can the Attack Be Detected?
SOC teams and system administrators can investigate the following behaviors to identify a potential MALFEX infection:
- Process analysis: Investigate unexpected relationships between
node.exeanddllhost.exe, including suspicious child processes. - Network traffic: Review unexpected connections to
raw.githubusercontent[.]com/cavecrew/projor the IP address104.234.65[.]75. - File and persistence checks: Search for
%TEMP%\svc_update.exe, suspicious startup entries, and scheduled tasks namedMicrosoftEdgeUpdateService. - Endpoint telemetry: Correlate process creation, outbound connections, and persistence activity using EDR, Sysmon, and Windows event logs.
References
1. SafeDep — Technical Analysis
Technical analysis of the imgdecode npm package and its native addon loader.
https://safedep.io/malfex-imgdecode-npm-native-addon-loader/
2. The Hacker News — MALFEX Campaign
Coverage of the suspicious npm package and its shellcode-loading mechanism.
https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html
3. Cloud Security Alliance — Research Note
Research on the MALFEX native addon loader and related supply chain security risks.