npm Package imgdecode: Windows Loader Linked to MALFEX Campaign
SafeDep researchers identified a native Windows addon in the npm package imgdecode that activates when the library is loaded, downloads and decrypts content, and attempts to inject it into the dllhost.exe process.
Security firm SafeDep has identified the imgdecode Windows loader as a package linked to the MALFEX campaign in the npm registry. Versions 1.0.0 through 1.0.3 contained a native Node.js addon intended for Windows. According to the analysis, the addon activates when require('imgdecode') is called, rather than through a postinstall installation script.
The risk therefore affects Windows development and build systems where the package was not only installed but also loaded by an application or script. Simply checking postinstall scripts might not detect such a case.
How the imgdecode Windows loader works
SafeDep states that the native addon downloads encrypted content from GitHub, decrypts it, and then attempts to inject the result into the dllhost.exe process. This moves the malicious logic from JavaScript into a compiled native addon, which can complicate routine dependency checks in Node.js projects.
Version 1.0.3 was published on October 11, 2026. It removed the dependency on another package linked to MALFEX, named imgbundle. According to SafeDep, imgdecode was still available on npm on October 13. The Hacker News likewise reported on October 17 that the package remained available in the registry. However, its status after that date was not independently verified directly in the npm registry.
Link to the MALFEX campaign
SafeDep’s technical analysis links the imgdecode package to MALFEX through matching infrastructure elements and the hash of an earlier downloader. However, the researchers did not confirm that the shellcode downloaded specifically by the imgdecode package leads to the same stealer and remote access tool (RAT) observed in an earlier branch of the campaign. SafeDep describes this connection as an inference.
There is also no confirmed information about the successful exploitation of imgdecode against specific victims. The findings concern analysis of the package’s code and its technical connections, not a publicly documented incident involving a user.
What teams using imgdecode should check
Organizations that find imgdecode in lockfiles or dependency trees should remove the package and examine affected Windows hosts for signs of compromise. They should also consider rotating credentials that may have been exposed on such systems.
- Search for the imgdecode package in all lockfiles and build configurations.
- Verify whether the package was loaded on Windows systems.
- Examine affected hosts, including processes and network communications related to the incident.
- Monitor for possible removal of the package from npm or a security notice from the registry.
Researchers will continue monitoring new packages and accounts linked to MALFEX infrastructure, as well as any confirmation of user compromises.
Sources
- SafeDep – The original technical analysis of the package, its versions, loading mechanism, downloading and code injection, and links to MALFEX.
- The Hacker News – Independently summarizes SafeDep’s findings and reports that the package was still available on npm on October 17.
Verified and updated: October 17, 2026 15:24
