Malicious npm publisher accounts tied to a long-running Windows-focused campaign have pushed another payload, this time a package named imgdecode that smuggles a shellcode loader inside a compiled Node.js addon.
SafeDep found the package, uploaded September 30 by a user called malfexteste8 and downloaded 979 times. Its nine lines of JavaScript load a Windows dynamic link library. When a program calls require from a Windows console, the DLL fetches encrypted shellcode from GitHub, decrypts it and injects the result into a fresh dllhost.exe process.
The strain belongs to MALFEX, a supply-chain operation first documented by Checkmarx and CloudSEK that has been seeding the registry since August 2023 across five publisher handles, among them malfexkkj and malfex_user.
Why the addon hides so well
Compiled native modules slip past reviewers who only open the JavaScript. A package that looks like an image decoder, with a tiny script and a prebuilt binary, raises few eyebrows until someone inspects the addon itself.
Developers should pin and verify dependencies rather than trusting names that resemble useful utilities, and build pipelines should refuse packages published by accounts with no history. Token-level monitoring helps too: process creation by Node spawning dllhost.exe is rare enough to alert on. SafeDep said imgdecode was still live at publication.
