MALFEX npm Package ‘imgdecode’ Hides Shellcode Loader in Windows Native Addon

Yes—SafeDep identified imgdecode as a MALFEX npm package containing a malicious prebuilt Windows N-API addon. In versions 1.0.0 through 1.0.3, requiring the package loads prebuilds/win32-x64/imgdecode.node. From version 1.0.1, the addon can download encrypted content, decrypt it and inject it into a suspended dllhost.exe process while the module initializes.

The observed trigger is an interactive Windows console. Blocking npm install scripts does not block this module-load path. SafeDep did not recover the downloaded banner.jpg, so the final payload cannot be identified with certainty.

What imgdecode does

SafeDep’s October 13, 2026 analysis found that the package’s JavaScript entry point is only a loader for a compiled native module. Calling require('imgdecode') loads prebuilds/win32-x64/imgdecode.node, a 64-bit MSVC binary built with node-addon-api. The DLL exports napi_register_module_v1; its initialization routine runs before the module returns its normal exports.

#	Preview	Product	Price
1		Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software	$51.82	Buy on Amazon
2		Learning Malware Analysis: Explore the concepts, tools, and techniques to analyze and investigate...	$39.58	Buy on Amazon
3		MAoS - Malware Analysis on Steroids: Fighting Malware to the Death - Real-World Threats and Reverse...	$33.79	Buy on Amazon
4		Evasive Malware: A Field Guide to Detecting, Analyzing, and Defeating Advanced Threats	$52.32	Buy on Amazon
5		Malware Data Science: Attack Detection and Attribution	$57.00	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

The malicious routine proceeds when standard output belongs to an interactive Windows console. Redirected output can prevent the observed path from firing, but that condition is not a safety guarantee: a package that has loaded untrusted native code should still be investigated.

How the loader fetches and injects its payload

1. Module load: Node.js resolves the package and loads the Windows native addon.
2. Network request: The addon requests hxxps://raw.githubusercontent[.]com/cavecrew/proj/main/banner.jpg.
3. Decryption: It decrypts the returned data with AES-256-CBC.
4. Process injection: It creates or opens a suspended dllhost.exe process and injects the decrypted result.

SafeDep observed the loader behavior but did not obtain banner.jpg. A separate related banner.png sample delivered a Go downloader for a 71.5 MB MALFEX stealer/RAT executable. That similarity makes a connection plausible, but it does not establish that banner.jpg contains the same payload.

Versions and replacement timeline

SafeDep recorded 929 imgdecode downloads between September 30 and October 12, 2026. Download totals measure registry activity, not confirmed infections.

#1 Best Overall

Sale

Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software

$51.82

Buy on Amazon

Why install-script controls are insufficient

Many npm defenses focus on lifecycle scripts such as preinstall and postinstall. imgdecode is distinctive because the observed execution occurs when application code requires the module, not in an installation hook. A clean install with scripts disabled can therefore still load the malicious DLL if a project imports the package on a Windows x64 machine.

The native binary’s embedded PDB path ended in buildReleaseimgdecode.pdb. The presence of a prebuilt DLL without corresponding native source or a binding.gyp file is a warning sign for packages presented as ordinary JavaScript utilities.

Rank #2

Sale

Learning Malware Analysis: Explore the concepts, tools, and techniques to analyze and investigate Windows malware

$39.58

Buy on Amazon

Campaign context

Checkmarx described MALFEX as an apparent single-operator npm campaign active since August 2023. By October 1, 2026, eight malicious packages in the campaign had 40,767 recorded downloads. The package function-flag accounted for 37,419 of those downloads. These figures show exposure opportunities in the registry; they do not prove that those downloads became infections.

Advisory coverage is incomplete. OSV advisory MAL-2026-17320 covers cdn-img-fetch, while later replacement packages may require direct package inspection and lockfile review rather than reliance on a single advisory entry.

Rank #3

Sale

MAoS - Malware Analysis on Steroids: Fighting Malware to the Death - Real-World Threats and Reverse Engineering Tactics

$33.79

Buy on Amazon

Indicators defenders can hunt

Use these indicators together. A single connection to GitHub or a normal COM-related dllhost.exe process is not, by itself, proof of MALFEX activity.

What to do if a Windows machine loaded the package

SafeDep advises treating a workstation that loaded imgdecode as potentially compromised. The interactive-console condition and the missing final payload mean absence of an obvious crash or alert does not clear the host.

Quick Recap

SaleBestseller No. 1

Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software

$51.82

SaleBestseller No. 2

Learning Malware Analysis: Explore the concepts, tools, and techniques to analyze and investigate Windows malware

$39.58

SaleBestseller No. 3

MAoS - Malware Analysis on Steroids: Fighting Malware to the Death - Real-World Threats and Reverse Engineering Tactics

$33.79

SaleBestseller No. 4

Evasive Malware: A Field Guide to Detecting, Analyzing, and Defeating Advanced Threats

$52.32

SaleBestseller No. 5

Malware Data Science: Attack Detection and Attribution

$57.00

Best Value

Sale

Malware Data Science: Attack Detection and Attribution

$57.00

Buy on Amazon

Rank #4

Sale

Evasive Malware: A Field Guide to Detecting, Analyzing, and Defeating Advanced Threats

$52.32

Buy on Amazon

1. Isolate the workstation. Remove it from wired and wireless networks while preserving volatile evidence according to your incident-response procedures.
2. Preserve evidence. Record the project directory, package and lockfile versions, npm cache entries, shell history, process creation logs and network telemetry before deleting artifacts.
3. Check execution history. Look for require('imgdecode'), the prebuilds/win32-x64/imgdecode.node file, child processes from node.exe and connections to the defanged GitHub path.
4. Rotate credentials from a clean system. Prioritize tokens, SSH keys, cloud credentials and passwords that were available to the affected Windows account.
5. Review dependency scope. Search every repository and lockfile for imgdecode and related MALFEX package names, then inspect replacement packages directly instead of assuming an advisory feed is complete.
6. Rebuild from a trusted baseline. For systems handling sensitive credentials or source code, follow your organization’s containment and reinstallation standard rather than simply removing the npm directory.

What is confirmed—and what is not

• Confirmed: versions 1.0.0–1.0.3 were analyzed; the package contains a Windows x64 native addon; the observed path fetches, decrypts and injects content during module initialization.
• Confirmed: the loader targets a suspended dllhost.exe process and uses AES-256-CBC.
• Not confirmed: the exact contents of banner.jpg or whether it is the same 71.5 MB stealer/RAT delivered by the related banner.png sample.
• Not established by download counts: how many registry downloads resulted in executed code or compromised hosts.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

incident responseMALFEXNode.jsnpm securitysupply-chain securityWindows malware