INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Malfex Hides Shellcode in Windows Native Addon via npm

| 2026-10-17 11:11 LOW HIGH SUPPLY CHAIN MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX . The package, named " imgdecode ," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of the package is 1.0.3. "The npm package imgdecode hides a malicious loader in a compiled [IOC HIDDEN • LOGIN REQUIRED] addon," SafeDep said .
Technical Observables 52 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 52 IoCs Create Free Account
domains 13 files 7 urls 16 sha256 10 ips 4 sha1 1 md5 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
EUROPE EUROPE cryptocurrencycryptocurrency technologytechnology
Incident Timeline
‎August 2023
CloudSEK's Global Threat Intelligence team linked the MALFEX operation, which targeted a Windows native addon of an npm package 'imgdecode', to a single operator active since August 2023.
attribution CloudSEK’s Global Threat Intelligence
CloudSEK’s Global Threat Intelligence team, which shared its findings with Hackread.com, dubbed the operation MALFEX and linked it to a single operator active since August 2023.
attribution Hackread.com
CloudSEK’s Global Threat Intelligence team, which shared its findings with Hackread.com, dubbed the operation MALFEX and linked it to a single operator active since August 2023.
‎August 6, 2023
Threat actors using the alias MALFEX published malicious npm packages across five handles, including malfexteste3, to target Windows systems starting from August 6, 2023.
industry Technology
General Document Context
infrastructure Windows
" First documented by both Checkmarx and CloudSEK, MALFEX is the name assigned to a long-running campaign in which an unknown threat actor has been publishing malicious packages to npm since August 6, 2023, with an aim to compromise Windows systems.
organisation Checkmarx
" First documented by both Checkmarx and CloudSEK, MALFEX is the name assigned to a long-running campaign in which an unknown threat actor has been publishing malicious packages to npm since August 6, 2023, with an aim to compromise Windows systems.
organisation CloudSEK
" First documented by both Checkmarx and CloudSEK, MALFEX is the name assigned to a long-running campaign in which an unknown threat actor has been publishing malicious packages to npm since August 6, 2023, with an aim to compromise Windows systems.
organisation npm
" First documented by both Checkmarx and CloudSEK, MALFEX is the name assigned to a long-running campaign in which an unknown threat actor has been publishing malicious packages to npm since August 6, 2023, with an aim to compromise Windows systems.
organisation malfexteste3
These packages were published across five npm publisher handles: malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4.
‎September 26, 2026 - cdn
The timeline of events is as follows - September 26, 2026 - cdn-img-fetch, img-to-native, and native-runner 1.0.0 published September 28, 2026, at 4:06 p.m.
‎September 28, 2026
General Document Context The timeline of events is as follows - September 26, 2026 - cdn-img-fetch, img-to-native, and native-runner 1.0.0 published September 28, 2026, at 4:06 p.m.
industry Technology
General Document Context
‎September 30, 2026
UTC - imgdecode 1.0.0 published September 30, 2026, at 11:07 p.m.
infrastructure Windows
"Its nine-line JavaScript file loads a Windows dynamic-link library (DLL).
When a Node.js program calls require('imgdecode') from a Windows console, the DLL attempts to download encrypted shellcode from GitHub.
industry Technology
General Document Context
organisation UTC - npm
UTC - npm removes native-runner and img-to-native September 30, 2026, at 3:29 a.m.
organisation UTC
UTC - imgbundle 1.0.0 published, replacing img-to-native September 30, 2026, at 3:37 a.m.
organisation DLL
"Its nine-line JavaScript file loads a Windows dynamic-link library (DLL).
organisation Node.js
When a Node.js program calls require('imgdecode') from a Windows console, the DLL attempts to download encrypted shellcode from GitHub.
organisation GitHub
When a Node.js program calls require('imgdecode') from a Windows console, the DLL attempts to download encrypted shellcode from GitHub.
infrastructure 1.0.3
The latest version of the package is 1.0.3.
organisation Node.js addon
"The npm package imgdecode hides a malicious loader in a compiled Node.js addon," SafeDep said .
organisation SafeDep
"The npm package imgdecode hides a malicious loader in a compiled Node.js addon," SafeDep said .
‎October 6, 2026
General Document Context " Although the GitHub account "cavecrew" is no longer accessible, an Internet Archive screenshot of the image file dated October 6, 2026, shows that it's the same Go-based downloader used for retrieving the…
industry Technology
General Document Context
observable Node.js
" Although the GitHub account "cavecrew" is no longer accessible, an Internet Archive screenshot of the image file dated October 6, 2026, shows that it's the same Go-based downloader used for retrieving the Node.js stealer and remote access tool ("movinlike") from "104.234.65[.]75:700.
observable 104.234.65.75
" Although the GitHub account "cavecrew" is no longer accessible, an Internet Archive screenshot of the image file dated October 6, 2026, shows that it's the same Go-based downloader used for retrieving the Node.js stealer and remote access tool ("movinlike") from "104.234.65[.]75:700.
infrastructure Windows
For persistence, it adds a Registry Run key and creates a scheduled task named "MicrosoftEdgeUpdateService." Developers who have installed any of the aforementioned packages should treat their Windows systems as potentially compromised, isolate them, check for persistence entries, rotate credentials, and transfer funds to new wallets if seed phrases were stored in them.
infrastructure 104.234.65
" The Node.js application includes a .env file containing a command-and-control (C2) address ("104.234.65[.]75:7007") and a MALFEX license key, indicating the use of a malware builder or licensing system to craft such payloads.
organisation WebSocket
It can also establish a WebSocket connection to the C2 server, allowing it to accept commands for shell execution, file transfer, process control, clipboard access, screenshots, and mouse and keyboard input.
‎October 11, 2026
The npm package 'imgdecode' version 1.0.3 hides shellcode loader in a Windows native addon, which then downloads and executes the stealer binary using FFI module Koffi.
infrastructure 1.0.1
"From version 1.0.1, the DLL also downloads and decrypts the payload.
Versions 1.0.1 and 1.0.2 still call require('imgbundle') before loading the DLL.
industry Technology
General Document Context
infrastructure Windows
img-to-native decrypts the blob using the key "malfexteam2027" and writes the contents to disk as a Go executable ("%APPDATA%\Microsoft\Windows\node_runtime_helper.exe").
infrastructure 1.0.3
Version 1.0.3 removes that dependency and needs no other MALFEX package.
organisation FFI
Its primary responsibility is to locate a JPG file ("cdn-img-fetch/.runtime/rt.jpg"), extract shellcode from it, copy it into executable memory, and run it using Koffi , a Foreign Function Interface (FFI) module for Node.js.
infrastructure 1.0.0
" Like in the case of "runhelper," version 1.0.0 of " imgdecode " waits for "imgbundle" to write a file at the location "cdn-img-fetch/.runtime/" and, once it becomes available, reads its contents into memory, and passes them to a native Node.js addon for decoding the data.
infrastructure 1.0.2
Versions 1.0.1 and 1.0.2 still call require('imgbundle') before loading the DLL.
organisation JPEG
"If they match a JPEG or PNG signature, the DLL stops.
organisation PNG
"If they match a JPEG or PNG signature, the DLL stops.
‎2026/10/17
CloudSEK discovered indications that the operator is Portuguese-speaking, including Portuguese text in a repository and a Brazilian-linked GitHub handle.
infrastructure Windows
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon.
MALFEX Moves Its npm Loader into a Native Windows DLL..
The npm package `imgdecode` is part of the MALFEX campaign targeting Windows developers.
organisation CloudSEK
CloudSEK uncovered the MALFEX campaign using malicious npm packages to deploy Overlord RAT, steal Discord and browser data, and target Windows systems.
The campaign has been codenamed MALFEX by CloudSEK and Checkmarx.
CloudSEK tracks this activity under the moniker NEBULA.
organisation DLL
IOC - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL.
Requiring the package loads the DLL without an install script or build step.
organisation PNG
The attack uses eight malicious packages and three separate delivery paths, including a Windows executable disguised as a PNG and an encrypted program hidden after real image data.
One Chain Delivers Overlord RAT CloudSEK’s research identified packages including tlxbnhd , tldriver and mxdriver using npm installation scripts to download a Windows executable disguised as a PNG file.
organisation Discord
CloudSEK uncovered the MALFEX campaign using malicious npm packages to deploy Overlord RAT, steal Discord and browser data, and target Windows systems.
The malware runs anti-analysis checks that audit for the presence of virtual machines, sandboxes, and analysis tools like Process Monitor and Wireshark, before harvesting files matching seed phrases and specific extensions (.kdbx, .pem, .ppk, and .env), as well as data from Chromium-based web browsers, Discord, Telegram, cryptocurrency wallets, and gaming apps (Steam, Epic Games, Riot, Battle.ne…
organisation GitHub
" The malware distributed as part of the campaign has been codenamed PoeLLM owing to what has been described as a "creative" technique that hides the command-and-control (C2) address within a poem the threat actors wrote and hosted in a GitHub repository ("github[.]com/ejejejdfbbebe").
The operator used multiple npm accounts containing the Malfex name, along with a GitHub account called cavecrew.
organisation Telegram
The malware runs anti-analysis checks that audit for the presence of virtual machines, sandboxes, and analysis tools like Process Monitor and Wireshark, before harvesting files matching seed phrases and specific extensions (.kdbx, .pem, .ppk, and .env), as well as data from Chromium-based web browsers, Discord, Telegram, cryptocurrency wallets, and gaming apps (Steam, Epic Games, Riot, Battle.ne…
It also targeted browser cookies and credentials, cryptocurrency wallets and Telegram session data.
organisation Package
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon.
organisation IOC - Seven Fake AI SDK Packages
IOC - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL.
organisation Infect Windows Developers
MALFEX npm Malware Hides Executables in PNG Files to Infect Windows Developers.
organisation npm malware campaign
A long-running npm malware campaign called MALFEX is targeting Windows developers with remote access tools, data stealers, and hidden downloaders.
organisation Cyber Security News
The operator has published packages since August […] The post MALFEX npm Malware Hides Executables in PNG Files to Infect Windows Developers appeared first on Cyber Security News .
organisation Browser Data
MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data.
infrastructure 1.0.3
Versions 1.0.0–1.0.3, published by `malfexteste8`, contain a precompiled 64-bit Node.js native addon at `prebuilds/win32-x64/imgdecode.node`.
infrastructure 1.0.0
Versions 1.0.0–1.0.3, published by `malfexteste8`, contain a precompiled 64-bit Node.js native addon at `prebuilds/win32-x64/imgdecode.node`.
organisation Node.js
The package decrypted an embedded payload and eventually fetched a 64 MB Node.js bundle.
organisation github[.]com
" The malware distributed as part of the campaign has been codenamed PoeLLM owing to what has been described as a "creative" technique that hides the command-and-control (C2) address within a poem the threat actors wrote and hosted in a GitHub repository ("github[.]com/ejejejdfbbebe").
organisation Microsoft
The addon is a 64-bit Microsoft Visual C++ (MSVC) DLL that first checks if it's running in a developer's terminal, and then proceeds to fetch a JPG file ("banner.jpg") from the same repository ("cavecrew/proj"), decrypt the embedded payload using the key "nif-runtime-2027," and ultimately inject the output into "dllhost.exe." "After decryption, the DLL checks the first bytes of the plaintext,"…
organisation Checkmarx
The campaign has been codenamed MALFEX by CloudSEK and Checkmarx.
organisation NEBULA
CloudSEK tracks this activity under the moniker NEBULA.
organisation npm
Another, cdn-img-fetch , remained available after npm removed its parent package, img-to-native .
infrastructure 1.0.1
From version 1.0.1, malicious execution occurs during the N-API module initialization routine.
organisation Process Monitor
The malware runs anti-analysis checks that audit for the presence of virtual machines, sandboxes, and analysis tools like Process Monitor and Wireshark, before harvesting files matching seed phrases and specific extensions (.kdbx, .pem, .ppk, and .env), as well as data from Chromium-based web browsers, Discord, Telegram, cryptocurrency wallets, and gaming apps (Steam, Epic Games, Riot, Battle.ne…
organisation Wireshark
The malware runs anti-analysis checks that audit for the presence of virtual machines, sandboxes, and analysis tools like Process Monitor and Wireshark, before harvesting files matching seed phrases and specific extensions (.kdbx, .pem, .ppk, and .env), as well as data from Chromium-based web browsers, Discord, Telegram, cryptocurrency wallets, and gaming apps (Steam, Epic Games, Riot, Battle.ne…
organisation Chromium
The malware runs anti-analysis checks that audit for the presence of virtual machines, sandboxes, and analysis tools like Process Monitor and Wireshark, before harvesting files matching seed phrases and specific extensions (.kdbx, .pem, .ppk, and .env), as well as data from Chromium-based web browsers, Discord, Telegram, cryptocurrency wallets, and gaming apps (Steam, Epic Games, Riot, Battle.ne…
organisation Steam,
The malware runs anti-analysis checks that audit for the presence of virtual machines, sandboxes, and analysis tools like Process Monitor and Wireshark, before harvesting files matching seed phrases and specific extensions (.kdbx, .pem, .ppk, and .env), as well as data from Chromium-based web browsers, Discord, Telegram, cryptocurrency wallets, and gaming apps (Steam, Epic Games, Riot, Battle.ne…
organisation Battle.net
The malware runs anti-analysis checks that audit for the presence of virtual machines, sandboxes, and analysis tools like Process Monitor and Wireshark, before harvesting files matching seed phrases and specific extensions (.kdbx, .pem, .ppk, and .env), as well as data from Chromium-based web browsers, Discord, Telegram, cryptocurrency wallets, and gaming apps (Steam, Epic Games, Riot, Battle.ne…
organisation nebulallms2
The operation spans seven identified packages distributed across four sequential burner accounts (nebulallms , nebulallms2 , nebulallms3 , nebulallms4 ).
organisation XMRig and Iron
The financially motivated campaign, dubbed Canto Incognito , has been found to install cryptocurrency miners, including XMRig and Iron, and connects victims to Kryptex, a Russian cryptocurrency mining service.
organisation Kryptex
The financially motivated campaign, dubbed Canto Incognito , has been found to install cryptocurrency miners, including XMRig and Iron, and connects victims to Kryptex, a Russian cryptocurrency mining service.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon.
"Its nine-line JavaScript file loads a Windows dynamic-link library (DLL).
When a Node.js program calls require('imgdecode') from a Windows console, the DLL attempts to download encrypted shellcode from GitHub.
" First documented by both Checkmarx and CloudSEK, MALFEX is the name assigned to a long-running campaign in which an unknown threat actor has been publishing malicious packages to npm since August 6, 2023, with an aim to compromise Windows systems.
img-to-native decrypts the blob using the key "malfexteam2027" and writes the contents to disk as a Go executable ("%APPDATA%\Microsoft\Windows\node_runtime_helper.exe").
For persistence, it adds a Registry Run key and creates a scheduled task named "MicrosoftEdgeUpdateService." Developers who have installed any of the aforementioned packages should treat their Windows systems as potentially compromised, isolate them, check for persistence entries, rotate credentials, and transfer funds to new wallets if seed phrases were stored in them.
MALFEX Moves Its npm Loader into a Native Windows DLL..
The npm package `imgdecode` is part of the MALFEX campaign targeting Windows developers.
The loader runs only when standard output is attached to an interactive Windows console, reducing activation in CI environments, sandboxes, and redirected-output contexts.
IOC - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL.
In late September 2026, a single actor deployed a series of malicious npm packages posing as a "NebulaAI" software development kit to deliver a Windows remote-access trojan.
MALFEX npm Malware Hides Executables in PNG Files to Infect Windows Developers.
A long-running npm malware campaign called MALFEX is targeting Windows developers with remote access tools, data stealers, and hidden downloaders.
The attack uses eight malicious packages and three separate delivery paths, including a Windows executable disguised as a PNG and an encrypted program hidden after real image data.
The operator has published packages since August […] The post MALFEX npm Malware Hides Executables in PNG Files to Infect Windows Developers appeared first on Cyber Security News .
MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data.
CloudSEK uncovered the MALFEX campaign using malicious npm packages to deploy Overlord RAT, steal Discord and browser data, and target Windows systems.
A long-running supply-chain campaign has used malicious npm packages to deliver a remote access trojan ( RAT ), steal credentials and maintain access to compromised Windows systems.
One Chain Delivers Overlord RAT CloudSEK’s research identified packages including tlxbnhd , tldriver and mxdriver using npm installation scripts to download a Windows executable disguised as a PNG file.
Metrics
infrastructure
‎1.0.3
Software Version
The latest version of the package is 1.0.3.
Version 1.0.3 removes that dependency and needs no other MALFEX package.
Versions 1.0.0–1.0.3, published by `malfexteste8`, contain a precompiled 64-bit Node.js native addon at `prebuilds/win32-x64/imgdecode.node`.
Metrics
infrastructure
‎1.0.1
Software Version
"From version 1.0.1, the DLL also downloads and decrypts the payload.
Versions 1.0.1 and 1.0.2 still call require('imgbundle') before loading the DLL.
From version 1.0.1, malicious execution occurs during the N-API module initialization routine.
Metrics
infrastructure
‎1.0.2
Software Version
Versions 1.0.1 and 1.0.2 still call require('imgbundle') before loading the DLL.
Metrics
infrastructure
‎1.0.0
Software Version
" Like in the case of "runhelper," version 1.0.0 of " imgdecode " waits for "imgbundle" to write a file at the location "cdn-img-fetch/.runtime/" and, once it becomes available, reads its contents into memory, and passes them to a native Node.js addon for decoding the data.
Versions 1.0.0–1.0.3, published by `malfexteste8`, contain a precompiled 64-bit Node.js native addon at `prebuilds/win32-x64/imgdecode.node`.
Metrics
infrastructure
‎104.234.65
Software Version
" The Node.js application includes a .env file containing a command-and-control (C2) address ("104.234.65[.]75:7007") and a MALFEX license key, indicating the use of a malware builder or licensing system to craft such payloads.
Metrics
infrastructure
‎Ivanti
Affected Product
The attacks have been primarily found to single out enterprise, internet-facing deployments such as LiteLLM and Gotenberg, as well as Gitea and Ivanti Sentry appliances.
Metrics
infrastructure
3,400
Victim Servers
Evidence indicates that the malware has been active since April 2026, with more than 3400 victim servers identified so far.
Metrics
infrastructure
2,200
Affected Servers
"At the peak of operations in mid-June, the campaign involved almost 2,200 affected servers, with nearly 800 active per day," the cybersecurity company said.
Intelligence Sources
The Hacker News 2026-10-17
AlienVault OTX 2026-10-15
AlienVault OTX 2026-10-14
HackRead 2026-09-30
AlienVault OTX 2026-10-07
The Hacker News 2026-10-07
AlienVault OTX 2026-10-08