Malicious npm Package 'imgdecode' Found Hiding Malware in Windows Addon

Timeline and Discovery

Researchers have found a malicious npm package named 'imgdecode' that is part of a broader supply chain attack campaign known as MALFEX. The package was uploaded to the npm registry on 30 September 2026 by a user called 'malfexteste8'. As of mid-October, it had been downloaded 979 times and was still available for download. The campaign has been active since August 2023, with attackers repeatedly uploading new packages after previous ones were removed by npm. The attackers responded quickly to removals, publishing replacements within days.

The campaign uses several npm accounts and package names, including 'cdn-img-fetch', 'img-to-native', 'native-runner', 'runhelper', 'imgbundle', and 'imgdecode'. The attackers have shown persistence and adaptability, changing tactics and package names to avoid detection and removal.

How the Attack Works

The malicious packages are designed to target Windows systems. Unlike some other malware, these packages do not use an install hook (a script that runs automatically when the package is installed). Instead, the malicious code is triggered when certain packages are loaded in a Node.js project.

The attack chain involves several steps:

• One package downloads an image file from a GitHub repository and extracts an encrypted blob.
• Another package decrypts the blob and writes it to disk as an executable file.
• A further package runs this executable, which then downloads a stealer binary from a remote server.

The 'imgdecode' package specifically includes a compiled Windows DLL (a type of Windows program library) that checks if it is running in a developer's terminal. If not, it fetches an image file from the same GitHub repository, decrypts an embedded payload, and injects it into a Windows process. This process can be turned off by the attacker by serving a harmless image instead of the malware.

What the Malware Does

Once running, the malware performs several actions:

• It checks for signs of being analysed, such as running inside a virtual machine or with monitoring tools.
• It searches for files containing sensitive data, including password manager databases, private keys, and environment files.
• It steals data from web browsers, messaging apps (Discord, Telegram), cryptocurrency wallets, and gaming platforms.
• It connects to a command-and-control server, allowing attackers to run commands, transfer files, take screenshots, and control the mouse and keyboard.
• It creates persistence on the infected system by adding itself to the Windows Registry and creating a scheduled task.

The malware uses a licensing system, suggesting the attackers may be selling access to the malware or providing it as a service to others.

Who Is at Risk and What Should Developers Do?

Anyone who has installed 'imgdecode' or related packages on a Windows system is at risk. Developers are advised to treat any affected systems as compromised. Steps to take include isolating the system, checking for persistence mechanisms, rotating credentials, and moving funds if cryptocurrency wallets were exposed.

The npm registry has removed some of the malicious packages, but as of the latest report, 'imgdecode' was still available. The GitHub account used to host the malicious files has been taken down, but the malware infrastructure may still be active.

Ongoing Investigation and Uncertainties

This information comes from a single secondary source (The Hacker News↗ (opens in a new tab)). There is no confirmation yet from npm, Microsoft, or law enforcement. The full extent of the impact is not yet known, and the number of affected users could change if more downloads are discovered or if the malware is found in other packages.