Researchers at SafeDep have identified a malicious npm package named imgdecode that conceals a shellcode loader inside a compiled Windows native addon. The package, uploaded on September 30, 2026, by the user malfexteste8, has been downloaded 979 times and remains available on npm. Its nine-line JavaScript file loads a Windows DLL, which then attempts to download encrypted shellcode from a GitHub repository, decrypt it, and inject it into a new dllhost.exe process.
imgdecode is part of the MALFEX campaign, a long-running supply chain attack first documented by Checkmarx and CloudSEK. The campaign has used multiple npm publisher handles and at least eight packages since August 2023, with some acting as loaders for Overlord RAT and others forming a Node.js stealer chain. The threat actor appears to respond quickly to public disclosures and npm removals, publishing replacements within days — imgdecode itself was published hours after runhelper was removed.
According to SafeDep, version 1.0.0 of imgdecode waited for another MALFEX package to write a file before decoding it, while versions 1.0.1 and 1.0.2 still called require('imgbundle'). Version 1.0.3 removes that dependency and operates standalone. The DLL also performs anti-analysis checks for virtual machines, sandboxes, and tools like Process Monitor and Wireshark, and the campaign infrastructure includes a command-and-control address and a license key, suggesting the use of a malware builder or licensing system.