MALFEX npm Package 'imgdecode' Hides Shellcode Loader Inside a Windows Native Addon

A Loader Written in Compiled Code, Not JavaScript

Researchers have uncovered the latest escalation in the MALFEX npm supply-chain campaign: a package named imgdecode that conceals its malicious loader inside a compiled Windows native addon rather than plain JavaScript. The package was uploaded to the npm registry on September 30, 2026, by a publisher account named malfexteste8, and has been downloaded 979 times as of the latest count.

According to analysis from SafeDep, the package's top-level JavaScript file is only nine lines long — just enough to load a prebuilt Windows DLL (prebuilds/win32-x64/imgdecode.node). From version 1.0.1 onward, the malicious logic runs inside the native addon's N-API module initialization function, meaning no postinstall script is needed to trigger it. Simply require('imgdecode') is enough.

How the Attack Works

Shifting the malicious logic out of JavaScript and into a compiled binary is a deliberate evasion move: most automated supply-chain scanners are built to analyze JS source code, and a nine-line loader stub gives them almost nothing to flag. The actual malicious behavior only becomes visible once the native addon itself is reverse-engineered.

Part of a Fast-Moving Campaign

imgdecode isn't an isolated incident — it's the latest package in an npm cat-and-mouse campaign that has been evolving for weeks:

• Earlier MALFEX packages native-runner and img-to-native formed a prior loader chain: img-to-native fetched an encrypted blob from the same cavecrew/proj GitHub repository, decrypted it with a hardcoded key, and wrote the result to disk as a Go executable in the AppData folder — with no package in the chain using an install hook.
• After Checkmarx publicly disclosed that chain and npm removed the packages, the operator responded within two days, publishing replacements named runhelper and imgbundle.
• imgdecode version 1.0.3 — the fully native-addon variant — was published on October 11, 2026, six days after the Checkmarx report, marking the campaign's shift from JavaScript loaders to compiled binaries.

The rapid republishing cadence — removal followed by a renamed replacement within 48 hours — shows an operator actively monitoring takedown activity and iterating around it rather than abandoning the campaign.

Why This Matters

• Detection evasion by design: moving the loader into a compiled N-API addon defeats static analysis tools built around parsing JavaScript, a growing trend as npm supply-chain scanners mature
• No install-script dependency: npm ecosystems increasingly flag or restrict postinstall scripts; executing from the addon's native init function sidesteps that specific defense
• Sandbox-aware payloads: the interactive-console check means automated malware sandboxes and CI pipelines with piped output may never observe the malicious behavior, inflating false confidence in "clean" scan results
• Persistent operator: the campaign has already cycled through at least five package names (native-runner, img-to-native, runhelper, imgbundle, imgdecode) in response to takedowns

Recommendations

For Developers

• Audit new dependencies for native addons (.node files, binding.gyp, prebuilds/ directories) with the same scrutiny applied to install scripts — native code is harder to review but just as capable of arbitrary execution
• Avoid installing unfamiliar, recently-published npm packages — especially single-purpose utility packages with generic names like "imgdecode" — without checking publisher history and download patterns
• Run npm install in CI/sandboxed environments by default so any console-interactivity-gated payloads are less likely to find a live target

For Security Teams

• Monitor for outbound connections to GitHub repositories serving binary blobs disguised as image files (e.g., banner.png) from build or developer workstations
• Flag process injection into dllhost.exe or other suspended legitimate Windows processes as a high-priority detection rule
• Treat npm packages with no install script but a native addon as requiring the same review bar as those with postinstall hooks — the execution trigger has simply moved

For the npm Ecosystem

• This campaign underscores that supply-chain defense built solely around JavaScript source scanning has a blind spot: compiled native addons. Registries and scanners should extend analysis to prebuilt binaries bundled in packages, not just the JS entry point.

MALFEX's pivot to native code is a reminder that supply-chain attackers adapt as fast as the defenses built against them — and that "no install script" is no longer a reliable signal of safety.