Researchers at SafeDep have found a malicious npm package called imgdecode that belongs to MALFEX, a long-running campaign in which an unknown actor has published malicious packages to npm since August 2023, aiming to compromise Windows machines. imgdecode was uploaded on September 30, 2026 by a user named “malfexteste8”, had been downloaded 979 times when The Hacker News reported on it, and was still available on npm. Its latest version is 1.0.3.
The package is only a nine-line JavaScript file that loads a compiled Windows DLL. When a Node.js program calls require('imgdecode') from a Windows console, the DLL checks that it is running in a developer’s terminal, downloads an encrypted payload disguised as an image from a GitHub repository, decrypts it and injects the result into a new dllhost.exe process. The operator appears to be responding to takedowns: after npm removed earlier MALFEX packages, replacements appeared within two days, and imgdecode was published about six hours after one of them was unpublished. From version 1.0.3 it no longer depends on any other MALFEX package.
The payload in related packages is a Node.js stealer and remote access tool. According to the report, it harvests files matching seed phrases and extensions such as .kdbx, .pem, .ppk and .env, plus data from Chromium-based browsers, Discord, Telegram, cryptocurrency wallets and gaming apps. It can also take commands over a WebSocket connection (shell execution, file transfer, screenshots, keyboard and mouse input) and persists through a Registry Run key and a scheduled task named “MicrosoftEdgeUpdateService”.
How to check if you’re affected
Affected products are Windows developer machines or build hosts where a Node.js project installed or ran any of the MALFEX packages named in the reporting: imgdecode (versions 1.0.0 to 1.0.3), imgbundle, runhelper, cdn-img-fetch, img-to-native and native-runner. Search your package.json, lockfiles and node_modules for those names.
If you find one, The Hacker News says to treat the Windows system as potentially compromised: isolate it, check for persistence entries (the Run key and the “MicrosoftEdgeUpdateService” scheduled task described above), rotate credentials, and move funds to new wallets if seed phrases were stored on the machine. The reported command-and-control address is 104.234.65[.]75.