/
← Voltar ao feed
high technology software development cryptocurrency

MALFEX npm campaign: 'imgdecode' package hides shellcode loader in Windows native addon, delivers Node.js stealer/RAT

1 fonte(s) · 1 atualização(ões) · publicado 17/10/2026 08:11 · coletado há 2 dias

Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has pushed malicious npm packages since August 6, 2023 across five publisher handles to compromise Windows systems, delivering Overlord RAT and a Node.js stealer/RAT ("movinlike"). The operator republished replacement packages within two days of npm takedowns, showing active adaptation to public disclosure. The stealer harvests browser data, crypto wallets, seed phrases, messaging and gaming accounts, and provides remote control via WebSocket.

Detalhes técnicos

  • imgdecode: a nine-line JavaScript file loads a 64-bit MSVC DLL (Node.js addon). When require('imgdecode') runs from a Windows console (developer terminal check), the DLL fetches banner.jpg from the GitHub repo cavecrew/proj, decrypts the embedded payload with the key "nif-runtime-2027", and injects it into a new dllhost.exe process. If the plaintext starts with a JPEG/PNG signature the DLL stops, which the researchers infer is an operator kill switch. Versions 1.0.1 and 1.0.2 still require imgbundle; 1.0.3 is standalone.
  • Node.js stealer chain (no install hook): cdn-img-fetch downloads banner.png and extracts an encrypted blob; img-to-native decrypts it with key "malfexteam2027" and writes a Go executable to %APPDATA%\Microsoft\Windows\node_runtime_helper.exe; native-runner runs it, and it downloads setup.exe (movinlike) from 104.234.65[.]75:700. Malicious code runs on package load via the dependency chain.
  • runhelper: extracts shellcode from cdn-img-fetch/.runtime/rt.jpg, copies it into executable memory and runs it via the Koffi FFI module. It was unpublished, and imgdecode appeared about six hours later.
  • Other infection paths: three packages load Overlord RAT; another uses a postinstall hook to contact an external server and fetch an unspecified next-stage binary.
  • Stealer capabilities: anti-analysis checks (VMs, sandboxes, Process Monitor, Wireshark); theft of seed phrases and files (.kdbx, .pem, .ppk, .env), Chromium browser data, Discord, Telegram, crypto wallets, and Steam, Epic Games, Riot, Battle.net, Minecraft and Ubisoft data. C2 at 104.234.65[.]75:7007 over WebSocket supports shell execution, file transfer, process control, clipboard access, screenshots and mouse/keyboard input. A .env file holds a MALFEX license key, suggesting a builder or licensing system. Persistence uses a Registry Run key and a scheduled task named "MicrosoftEdgeUpdateService".
  • Timeline: npm removed native-runner and img-to-native (Sep 28), imgbundle (Oct 7) and cdn-img-fetch (Oct 8); imgdecode 1.0.3 was published Oct 11.

Remediação

  • Treat Windows systems that installed any listed package as potentially compromised: isolate them and check for persistence (Run keys, the "MicrosoftEdgeUpdateService" scheduled task, node_runtime_helper.exe).
  • Rotate credentials and secrets, and move funds to new wallets if seed phrases were stored on affected hosts.
  • Block the C2 IP and audit dependency trees for the listed packages.

Linha do tempo

  1. thehackernews.com ↗ · pub. 17/10/2026 08:11 · coletado 19/10 17:53 primeiro registro

    MALFEX npm campaign: 'imgdecode' package hides shellcode loader in Windows native addon, delivers Node.js stealer/RAT

    ler a análise desta fonte

    Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has pushed malicious npm packages since August 6, 2023 across five publisher handles to compromise Windows systems, delivering Overlord RAT and a Node.js stealer/RAT ("movinlike"). The operator republished replacement packages within two days of npm takedowns, showing active adaptation to public disclosure. The stealer harvests browser data, crypto wallets, seed phrases, messaging and gaming accounts, and provides remote control via WebSocket.

    Technical Details

    • imgdecode: a nine-line JavaScript file loads a 64-bit MSVC DLL (Node.js addon). When require('imgdecode') runs from a Windows console (developer terminal check), the DLL fetches banner.jpg from the GitHub repo cavecrew/proj, decrypts the embedded payload with the key "nif-runtime-2027", and injects it into a new dllhost.exe process. If the plaintext starts with a JPEG/PNG signature the DLL stops, which the researchers infer is an operator kill switch. Versions 1.0.1 and 1.0.2 still require imgbundle; 1.0.3 is standalone.
    • Node.js stealer chain (no install hook): cdn-img-fetch downloads banner.png and extracts an encrypted blob; img-to-native decrypts it with key "malfexteam2027" and writes a Go executable to %APPDATA%\Microsoft\Windows\node_runtime_helper.exe; native-runner runs it, and it downloads setup.exe (movinlike) from 104.234.65[.]75:700. Malicious code runs on package load via the dependency chain.
    • runhelper: extracts shellcode from cdn-img-fetch/.runtime/rt.jpg, copies it into executable memory and runs it via the Koffi FFI module. It was unpublished, and imgdecode appeared about six hours later.
    • Other infection paths: three packages load Overlord RAT; another uses a postinstall hook to contact an external server and fetch an unspecified next-stage binary.
    • Stealer capabilities: anti-analysis checks (VMs, sandboxes, Process Monitor, Wireshark); theft of seed phrases and files (.kdbx, .pem, .ppk, .env), Chromium browser data, Discord, Telegram, crypto wallets, and Steam, Epic Games, Riot, Battle.net, Minecraft and Ubisoft data. C2 at 104.234.65[.]75:7007 over WebSocket supports shell execution, file transfer, process control, clipboard access, screenshots and mouse/keyboard input. A .env file holds a MALFEX license key, suggesting a builder or licensing system. Persistence uses a Registry Run key and a scheduled task named "MicrosoftEdgeUpdateService".
    • Timeline: npm removed native-runner and img-to-native (Sep 28), imgbundle (Oct 7) and cdn-img-fetch (Oct 8); imgdecode 1.0.3 was published Oct 11.

    Remediation

    • Treat Windows systems that installed any listed package as potentially compromised: isolate them and check for persistence (Run keys, the "MicrosoftEdgeUpdateService" scheduled task, node_runtime_helper.exe).
    • Rotate credentials and secrets, and move funds to new wallets if seed phrases were stored on affected hosts.
    • Block the C2 IP and audit dependency trees for the listed packages.