MALFEX npm package 'imgdecode' hides shellcode loader in a Windows native addon
A still-available npm package tied to the MALFEX campaign loads a Windows DLL that downloads, decrypts and injects shellcode, SafeDep found.
At a glance
- imgdecode was uploaded on September 30 by 'malfexteste8' and had 979 downloads, according to The Hacker News.
- Its nine-line JavaScript file loads a DLL inside a compiled Node.js addon that injects shellcode into dllhost.exe.
- The wider MALFEX campaign has pushed Windows-targeting npm packages since August 2023, including an Overlord RAT loader and a stealer.
- Anyone who installed the packages should treat the Windows system as compromised and rotate credentials.
A malicious npm package named imgdecode, linked to the long-running MALFEX campaign, hides a shellcode loader inside a compiled Windows native addon, The Hacker News reported on October 17, citing an analysis by software supply chain security firm SafeDep. The package was uploaded on September 30 by the user malfexteste8, had been downloaded 979 times at the time of writing and was still available on the registry, according to the report. Hiding the payload in a binary addon rather than in JavaScript makes it harder to spot with source code review.
What happened
According to The Hacker News, imgdecode contains a nine-line JavaScript file that loads a Windows DLL packaged inside a compiled Node.js addon. When a Node.js program running in a Windows console calls require('imgdecode'), the DLL downloads encrypted shellcode from GitHub, decrypts it and injects it into a new dllhost.exe process.
Earlier versions depended on a companion package, imgbundle, which wrote a file that was then passed to the addon; version 1.0.3, published on October 11, removed that dependency. npm removed imgbundle on October 7-8.
Technical details
SafeDep said the DLL is a 64-bit MSVC build that checks whether it runs in a developer terminal and fetches a JPG image from a GitHub repository before decrypting an embedded payload. If the decrypted data begins with a JPEG or PNG signature, the DLL stops, which SafeDep inferred could serve as a switch the operator uses to turn the loader off.
The broader MALFEX campaign, first documented by Checkmarx and CloudSEK, has published Windows-targeting npm packages since August 6, 2023, using publisher handles such as malfexkkj, malfex_user and malfexteste2 through malfexteste4, the report said. Its packages have acted as loaders for the Overlord RAT and formed a Node.js stealer chain (cdn-img-fetch, img-to-native, native-runner) that drops a Go executable to %APPDATA%\Microsoft\Windows\node_runtime_helper.exe. The final stealer targets seed phrases, .kdbx, .pem, .ppk and .env files, Chromium browser data, Discord, Telegram, cryptocurrency wallets and gaming accounts, and offers remote control over WebSocket. It persists through a Registry Run key and a scheduled task named MicrosoftEdgeUpdateService.
Who is affected
Developers and build systems on Windows that installed imgdecode or other MALFEX packages are at risk. The operator has repeatedly replaced removed packages with new ones, The Hacker News noted.
What to do
- Check dependency trees and lock files for
imgdecode,imgbundle,runhelperand the other packages named above. - Treat any Windows system that installed them as potentially compromised and isolate it from the network.
- Look for the
MicrosoftEdgeUpdateServicescheduled task, Run key persistence and connections to104.234.65.75. - Rotate credentials and, if seed phrases were stored on the machine, move funds to new wallets.
Sources
This story is based on the sources listed above. Always check the vendor’s official advisory before acting on critical systems.
