# MALFEX Campaign Continues with Malicious npm Package 'imgdecode'

*Published October 19, 2026*
*Source: [https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html](https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/malfex-campaign-continues-with-malicious-npm-package-imgdecode) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Cybersecurity experts have identified a harmful npm package named 'imgdecode' as part of the ongoing MALFEX software supply chain attack campaign. This package was uploaded to the npm registry on September 30, 2026, by a user known as 'malfexteste8' and has been downloaded 979 times. The 'imgdecode' package contains a malicious loader within a Node.js addon, which is designed to load a Windows DLL. When a Node.js application uses 'require('imgdecode')' in a Windows environment, the DLL attempts to download encrypted shellcode from GitHub, decrypt it, and inject it into a new dllhost.exe process.

MALFEX is a campaign that began on August 6, 2023, involving an unknown threat actor who has been releasing harmful packages on npm to target Windows systems. The campaign has used various npm publisher handles and has released multiple packages, some acting as loaders for the Overlord RAT, while others work together to download and execute a Node.js stealer. The threat actor has been quick to respond to public disclosures and removals by replacing packages with new ones.

The package 'runhelper' was initially published as a utility for launching native binaries, yet functioned similarly to 'native-runner' by running malicious code. It extracted shellcode from a JPG file and executed it. The 'imgdecode' package was subsequently released with a DLL to run shellcode, further evolving in versions to remove dependencies on other MALFEX packages. The malicious DLL checks if it operates in a developer's terminal and fetches a JPG file to decrypt a payload, which it injects into dllhost.exe.

Although the malicious GitHub account 'cavecrew' is no longer active, archived content showed it contained tools for retrieving a Node.js stealer and a remote access tool from a specified server. The malware includes anti-analysis measures and can collect sensitive data, interact with command-and-control servers, and maintain persistence on the compromised system. Developers who have utilized these packages should consider their systems compromised and take immediate steps to mitigate risks.