MALFEX npm Package imgdecode Hides a Windows Shellcode Loader
Summary
Researchers say MALFEX’s imgdecode npm package loads a Windows DLL that retrieves and decrypts shellcode, then injects it into dllhost.exe. The campaign’s malware can steal sensitive data, accept C2 commands, and establish persistence.
Key points
- The imgdecode package was uploaded on September 30, 2026, and was still available on npm when reported; its latest version was 1.0.3.
- When loaded by a Windows Node.js program, imgdecode’s DLL can retrieve encrypted shellcode, decrypt it, and inject it into a new dllhost.exe process.
- The researchers describe several MALFEX infection paths, including packages associated with Overlord RAT, a Node.js stealer, and a postinstall hook that retrieves an unspecified binary.
- The malware checks for virtual machines, sandboxes, and analysis tools, and can collect files, browser data, messaging and gaming app data, and cryptocurrency wallet information.
- Its WebSocket C2 can support shell commands, file transfers, process control, clipboard access, screenshots, and mouse and keyboard input; persistence uses a Registry Run key and scheduled task.
- Developers who installed the packages are advised to isolate potentially affected Windows systems, check for persistence, rotate credentials, and move funds to new wallets if seed phrases were stored.
Article Details
- Attack Vectors
- Malicious npm packages load a Windows native DLL or execute JavaScript that retrieves and runs additional payloads.
- The imgdecode DLL downloads encrypted shellcode from GitHub, decrypts it, and injects it into a new dllhost.exe process.
- The malware harvests files, browser and application data, and cryptocurrency wallet information, and communicates with its C2 server over WebSocket.
- The malware establishes persistence using a Registry Run key and a scheduled task named MicrosoftEdgeUpdateService.
- Defensive Notes
- Developers who installed the identified packages should treat their Windows systems as potentially compromised and isolate them.
- Check for persistence entries, rotate credentials, and transfer funds to new wallets if seed phrases were stored on affected systems.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]234[.]65[.]75 | Reported server used to retrieve the Node.js stealer and remote access tool movinlike. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware harvests local files matching seed phrases and specified extensions, along with data from browsers and applications.T1053.005 · Scheduled TaskThe malware creates a scheduled task named MicrosoftEdgeUpdateService for persistence.T1055 · Process InjectionThe imgdecode DLL decrypts shellcode and injects it into a new dllhost.exe process.T1071.001 · Web ProtocolsThe malware establishes a WebSocket connection to its C2 server to receive commands.T1105 · Ingress Tool TransferThe imgdecode DLL downloads encrypted shellcode, and other campaign packages retrieve payloads from external servers.T1113 · Screen CaptureThe malware's C2 commands include taking screenshots.T1115 · Clipboard DataThe malware's C2 commands include clipboard access.T1497 · Virtualization/Sandbox EvasionThe malware checks for virtual machines, sandboxes, and analysis tools before proceeding.T1547.001 · Registry Run Keys / Startup FolderThe malware persists by adding a Registry Run key.
Malware
movinlikethat it's the same Go-based downloader used for retrieving the Node.js stealer and remote access tool ("movinlike") from "104.234.65[.]75:700."Overlord RATOf the eight identified packages, three were found to act as a loader for Overlord RAT, while three others ("cdn-img-fetch," "img-to-native," and "native-runner") worked together to download and run a Node.js stealer. A
Products
Microsoft Windowsa malicious loader in a compiled Node.js addon," SafeDep said. "Its nine-line JavaScript file loads a Windows dynamic-link library (DLL). When a Node.js program calls require('imgdecode') from a Windows console, theNode.js"The npm package imgdecode hides a malicious loader in a compiled Node.js addon," SafeDep said. "Its nine-line JavaScript file loads a Windows dynamic-link library (DLL). When a Node.js program calls