MALFEX campaign uses malicious imgdecode npm package to hide shellcode loader in Windows addons

1. Executive summary

A malicious npm package named imgdecode, uploaded on 30 September 2026 by the account malfexteste8, is part of the MALFEX software supply chain campaign and remains available on the npm registry with 979 downloads recorded. MALFEX has been running since August 2023 and has published twelve packages, eight of which are malicious, accumulating 40,767 downloads and delivering information stealers and remote access trojans including Overlord RAT. The campaign is attributed by CloudSEK and Checkmarx to a lone threat actor, an assessment that is single-sourced to those two vendors and not corroborated elsewhere. No CVE has been assigned and no CVSS score, severity rating or CISA KEV entry exists for this item. The risk to EMEA financial services sits in developer workstations and CI/CD build runners that install npm dependencies: a package install is sufficient to execute a Windows native addon carrying a shellcode loader, with no exploitation step required.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The source material for this item is thin. The Hacker News primary item is truncated mid-sentence and the two related sources are short summaries. What follows separates what is confirmed from what is not.

Confirmed steps in the MALFEX delivery chain:

The actor publishes a package to the npm registry under a controlled account. imgdecode was uploaded on 30 September 2026 by the user malfexteste8.
The package is downloaded by developers or automated build systems that resolve it as a dependency. imgdecode has 979 downloads and was still available on npm at the time of publication.
The package carries a Windows native addon that conceals a shellcode loader. The loader is the mechanism by which the second-stage payload is executed on the host.
The second stage is an information stealer or a remote access trojan. Overlord RAT is named in the campaign reporting.

The campaign behind this package has run since August 2023. Twelve packages have been published across that period, eight of them malicious, with a combined 40,767 downloads. The campaign is tracked as MALFEX by CloudSEK and Checkmarx.

Technical specifics that a defender needs and that the sources do not provide: the exact imgdecode version numbers, the native addon filename and its binding path, the shellcode loader's execution trigger, any persistence mechanism, the command-and-control infrastructure, and the file paths or registry keys touched on an infected host. None of these appear in the primary item or the related sources. Do not assume them from other MALFEX reporting without verifying against the package contents.

Confidence caveats. The attribution to a lone threat actor rests on CloudSEK and Checkmarx reporting as relayed by The Hacker News; it is single-sourced to those two vendors and should be treated as unconfirmed. The 40,767 download figure and the twelve-package count come from the same reporting chain. The 979 download figure for imgdecode is from the primary item and is a point-in-time count that will have changed. No MITRE ATT&CK profile is available for this actor, so no technique mapping is asserted here.

The primary item is truncated. Any detail beyond the package name, upload date, uploader account, download count and availability status is not present in the supplied text and has not been inferred.

4. Mitigation & containment

P1 within 24 hours

Search every developer workstation, build runner and container image for imgdecode in npm dependency trees and lockfiles. Run npm ls imgdecode in each project root and grep package-lock.json, yarn.lock and pnpm-lock.yaml for the string imgdecode.
Where imgdecode is present, treat the host as compromised. The package carries a Windows native addon with a shellcode loader, so installation implies execution. Isolate the host, preserve volatile state, and start incident response rather than simply uninstalling.
Block the package at the registry proxy. If you run an internal npm mirror (Artifactory, Nexus, Verdaccio), add imgdecode to the deny list and re-sync. If developers pull directly from registry.npmjs.org, block the package name at the egress proxy until the registry removes it.
Check npm audit and CI logs for installs of imgdecode by the account malfexteste8 and for any package published by that account.

P2 within 72 hours

Review the full dependency inventory for the other MALFEX packages. The campaign has published twelve packages, eight malicious. The sources name only imgdecode and the campaign, not the other package names, so this requires pulling the current package list from CloudSEK or Checkmarx reporting rather than from this advisory.
Rotate credentials reachable from any host that installed imgdecode: npm tokens, cloud provider keys, CI/CD secrets, SSH keys, and any credentials in environment variables or dotfiles on the affected workstation or runner.
Hunt for Overlord RAT and stealer artefacts on affected hosts. The sources do not provide hashes, filenames or C2 addresses, so this hunt depends on your existing RAT and stealer detection content rather than on indicators from this advisory.

P3 within 7 days

Enforce lockfile integrity and a private registry mirror with an allowlist for new packages. A package published on 30 September and still live on 17 October with 979 downloads is a supply chain control failure, not a detection failure.
Require review before any package with a native addon (node-gyp, prebuild, .node binaries) enters a build. Native addons are the delivery vehicle here and are the least inspected part of most npm dependency trees.
Add a CI gate that fails a build when a dependency was published by an account younger than a set threshold or when a package version changes without a lockfile update.

5. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IP addresses, file paths, registry keys) are available in the source material. The sources name the package, the publishing account and the campaign, and describe the delivery mechanism, but provide no machine-pivotable values.

Behavioural indicators

behaviour	where to observe	confidence
npm install of package imgdecode	npm/CI logs, package-lock.json, yarn.lock, pnpm-lock.yaml	confirmed in primary item
Package published by npm account malfexteste8	npm registry metadata, registry proxy logs	confirmed in primary item
Windows native addon (.node) loaded during npm install or postinstall	EDR process telemetry, node.exe child process and module load events	confirmed as mechanism in primary item; specific filename not given
Shellcode loader execution from a Node.js process	EDR memory and process telemetry on developer workstations and build runners	confirmed as mechanism in primary item; specific trigger not given
Overlord RAT or stealer activity on a host that installed a MALFEX package	EDR, network telemetry	single-sourced to CloudSEK/Checkmarx via The Hacker News; verify before enforcement

No copyable indicator block is provided because the sources contain no atomic indicators.

6. Detection

The sources give usable artefacts for a file and package level rule: the package name imgdecode, the publishing account malfexteste8, and the native addon plus shellcode loader mechanism. The YARA rule below targets the package metadata and the native addon naming pattern. It will not match a renamed or repackaged variant, and it should be run against npm cache directories, node_modules trees and package tarballs rather than against memory.

rule MALFEX_imgdecode_npm_package
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-17"
        reference = "https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html"
        description = "Detects the MALFEX imgdecode npm package by package metadata and publishing account. Targets package.json and npm tarball contents."
        confidence = "medium"
    strings:
        $pkg = "\"name\": \"imgdecode\"" ascii
        $pkg2 = "\"name\":\"imgdecode\"" ascii
        $acct = "malfexteste8" ascii
        $addon = ".node" ascii
    condition:
        (any of ($pkg, $pkg2)) and $acct
}

The Sigma rule below covers the process behaviour: a Node.js process spawning or loading a native addon during install on a developer or build host. Tune the parent and child image names to your environment.

title: Node.js npm install loading native addon from untrusted package
id: 8f3c1a2e-5b7d-4e91-9c04-2a6d7f1b3e88
status: experimental
description: Detects node.exe loading a .node native addon during npm install, the delivery mechanism used by the MALFEX imgdecode package.
author: Adverse Trace
date: 2026/10/17
references:

    - https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:

            - '\node.exe'
            - '\npm.cmd'
    selection_child:
        Image|endswith: '\node.exe'
        CommandLine|contains:

            - 'node-gyp'
            - 'prebuild'
            - 'install'
    selection_addon:
        CommandLine|contains: '.node'
    condition: selection_parent and selection_child and selection_addon
falsepositives:

    - Legitimate packages with native addons built during install
level: medium

7. Sources

The Hacker News, MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon, https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html, 2026-10-17
SecurityWeek, Long-Running NPM Malware Campaign Accumulates 40,000 Downloads, https://www.securityweek.com/long-running-npm-malware-campaign-accumulates-40000-downloads/
The Hacker News, Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer, https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html

8. Adverse Trace position

No CVE, CVSS score, severity rating or CISA KEV entry exists for this item, so the severity assessment rests on the delivery mechanism rather than on a scored vulnerability: a live npm package with a Windows native addon shellcode loader, 979 downloads, and a campaign that has run for over two years with 40,767 downloads across eight malicious packages. The client impact is concentrated in developer workstations and CI/CD build runners, where a package install is enough to execute code and where credentials and build secrets are within reach. The attribution to a lone actor and the Overlord RAT and stealer payload detail are single-sourced to CloudSEK and Checkmarx via The Hacker News; we treat the attribution as unconfirmed and will not act on it. Adverse Trace will pull the full MALFEX package list from CloudSEK and Checkmarx reporting, obtain the imgdecode tarball for static analysis to extract the native addon filename, loader trigger and any C2 values, and reissue this advisory with atomic indicators and a tightened YARA rule once those artefacts are verified. Clients running npm dependency trees on Windows build hosts should complete the P1 dependency search today rather than waiting for the reissue.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.