MALFEX 2026: How a Nine-Line npm Package Smuggled a Shellcode Loader into Windows Developer Environments
Executive Summary
In late September 2026, threat researchers uncovered a sustained software supply-chain campaign dubbed MALFEX, in which an unknown threat actor published a series of malicious npm packages—most recently 'imgdecode'—targeting Windows developers. The package conceals a compiled Windows DLL inside a Node.js native addon; when loaded, the DLL fetches encrypted shellcode from a GitHub repository, decrypts it, and injects it into a legitimate dllhost.exe process. The malware deploys both the Overlord RAT and a Go-based Node.js infostealer ('movinlike') capable of harvesting browser credentials, crypto wallets, Discord, Telegram, seed phrases, SSH keys, and gaming platform tokens, while establishing a persistent WebSocket C2 channel and evading sandbox detection. Active since August 2023, the campaign has cycled through at least eleven package identities in direct response to npm takedowns.
This incident underscores an accelerating attacker pattern of weaponizing open-source package ecosystems to reach enterprise CI/CD pipelines and developer workstations. The adversary's rapid republishing cadence—replacing removed packages within hours—highlights the inadequacy of reactive registry enforcement and reinforces urgent demand for proactive supply-chain controls, network egress enforcement, and east-west segmentation in cloud-native environments.
Why This Matters Now
Software supply-chain attacks via npm and similar registries are surging in 2026, with threat actors now embedding compiled native binaries to evade JavaScript-layer scanning. MALFEX's operator demonstrated real-time operational resilience by republishing new package variants within hours of removal, meaning organizations relying solely on registry moderation are perpetually exposed. Any developer workstation or CI/CD pipeline that installed these packages should be treated as fully compromised.
Attack Path Analysis
The MALFEX campaign began with the publication of typosquatted and deceptively named npm packages that embedded shellcode loaders inside compiled Windows native addons, compromising developer environments upon package installation or import. Once loaded, the malicious DLL downloaded encrypted shellcode from GitHub, decrypted it, and injected it into a legitimate Windows process (dllhost.exe), enabling persistence via Registry Run keys and scheduled tasks, followed by C2 communication over WebSocket to a hardcoded IP, and culminating in broad credential, wallet, and browser data exfiltration.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The threat actor published malicious npm packages (imgdecode, cdn-img-fetch, img-to-native, native-runner, runhelper, imgbundle) under multiple publisher handles to the npm registry. Developers who ran 'npm install' or called 'require()' on these packages triggered the malicious loader chain. The packages masqueraded as legitimate image decoding or native runtime utilities, exploiting developer trust in the open-source supply chain. A compiled MSVC DLL embedded in the package fetched encrypted shellcode from a GitHub repository (cavecrew/proj) and injected it into dllhost.exe.
MITRE ATT&CK® Techniques
Compromise Software Supply Chain
Command and Scripting Interpreter: JavaScript
Process Injection: Dynamic-link Library Injection
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Scheduled Task/Job: Scheduled Task
Exfiltration Over C2 Channel
Virtualization/Sandbox Evasion: System Checks
Credentials from Password Stores: Credentials from Web Browsers
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Supply Chain Risk Management – Software Integrity Verification
Control ID: SA-12 / SR-3
PCI DSS 4.0 – Software Inventory and Payment Page Script Integrity
Control ID: Requirement 6.3.2 / 6.4.3
NYDFS 23 NYCRR 500 – Third-Party Service Provider Security and Incident Response
Control ID: 500.14(a) / 500.16
DORA (EU) 2022/2554 – ICT Third-Party Risk Management and Supply Chain Security
Control ID: Article 28 / Article 45
NIS2 Directive (EU) 2022/2555 – Supply Chain Security and Incident Handling
Control ID: Article 21(2)(a) / Article 21(2)(d)
CISA Zero Trust Maturity Model 2.0 – Software Supply Chain Integrity and Runtime Workload Isolation
Control ID: Application Pillar – Application Access / Visibility and Analytics
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
MALFEX supply-chain RAT/infostealer targets npm developers directly; malicious imgdecode package steals credentials, seed phrases, and browser data, triggering PCI.4.0.4.2.1 and NIST.800-53.SC-7 egress control failures during lateral movement and exfiltration stages.
Information Technology/IT
IT teams deploying Node.js pipelines face shellcode injection into dllhost.exe, C2 WebSocket persistence, and registry Run key implants, demanding Zero Trust Segmentation and Multicloud Visibility controls mapped to ZTMM.Network and NIST.CSF.DE.CM-7.
Financial Services
MALFEX infostealer harvests cryptocurrency wallets, .kdbx vaults, and .env C2 credentials, exposing financial sector firms to critical exfiltration risk requiring Egress Security enforcement aligned to PCI.4.0.3.5.1 and NIST.CSF.PR.DS-5.
Computer/Network Security
Security vendors and SOC teams using npm toolchains are primary MALFEX targets; compromised .pem/.ppk keys and sandbox-evading RAT persistence demand Inline IPS signature updates and Threat Detection controls per NIST.800-53.IR-5.
Sources
- MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addonhttps://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.htmlVerified
- Eight Malicious npm Packages Downloaded Thousands of Times Target Windows Developershttps://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.htmlVerified
- SafeDep Research: MALFEX imgdecode npm Native Addon Loaderhttps://safedep.io/malfex-imgdecode-npm-native-addon-loader/Verified
- npm Package imgdecode - Version Historyhttps://www.npmjs.com/package/imgdecode?activeTab=versionsVerified
- Socket.dev Analysis: runhelper npm Packagehttps://socket.dev/npm/package/runhelper/files/1.0.0/index.jsVerified
- Socket.dev Analysis: imgdecode npm Packagehttps://socket.dev/npm/package/imgdecode/files/1.0.0/index.jsVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this supply chain attack because the malware relied on unrestricted outbound connectivity from developer workstations to external GitHub delivery infrastructure and a hardcoded C2 IP to complete its execution chain. By enforcing workload-level segmentation and tightly scoped egress policies, Aviatrix would likely have reduced the attacker's ability to retrieve and activate shellcode payloads, constrained C2 reachability, and limited the blast radius of credential and wallet exfiltration.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Unvetted outbound connections from developer workloads to arbitrary GitHub delivery endpoints would likely be constrained, reducing the attacker's ability to complete the shellcode retrieval and activate the loader chain within cloud-connected environments.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies could reduce the scope of what a compromised workload identity is permitted to do or reach, likely constraining how far injected process activity could propagate across connected environments even if local persistence mechanisms succeed.
Control: East-West Traffic Security
Mitigation: East-west enforcement policies would likely constrain the attacker's ability to pivot from a compromised developer workstation toward cloud workloads or internal hosts, reducing reachable network paths even if valid SSH keys were successfully stolen.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control policies would likely surface and constrain anomalous outbound WebSocket sessions to hardcoded external IPs on non-standard ports, reducing the attacker's ability to maintain a reliable bidirectional C2 channel from within cloud-connected developer environments.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policies enforced at the workload boundary would likely constrain the outbound data paths available to the stealer process, reducing the volume and variety of credential and wallet data that could be successfully transmitted to the external C2 endpoint.
Where prior CNSF controls constrained egress and east-west reachability, the attacker's realized impact would likely be narrowed in scope — credential sets and wallet data that never left the environment reduce financial exposure, and cloud infrastructure reachable only through segmented paths would likely remain isolated from SSH pivoting attempts using harvested keys.
Impact at a Glance
Affected Business Functions
- Software Development Pipelines (npm dependency integrity)
- Developer Workstation Security and Secrets Management
- Cryptocurrency Wallet and Financial Asset Protection
- Application Security and CI/CD Supply Chain Integrity
Estimated downtime: 7 days
Estimated loss: N/A
Highly sensitive developer data at risk includes: cryptocurrency wallet seed phrases and private keys enabling direct theft of digital assets; SSH private keys (.ppk, .pem) and KeePass database files (.kdbx) enabling lateral movement and credential reuse; browser-stored credentials and session tokens from Chromium-based browsers; Discord and Telegram session tokens enabling account takeover; gaming platform credentials (Steam, Epic Games, Riot, Battle.net, Minecraft, Ubisoft); .env files containing API keys, secrets, and cloud service credentials; arbitrary shell command execution and file transfer capability via WebSocket C2 connection; and full remote access trojan (Overlord RAT) deployment on Windows developer systems. Any developer who executed require('imgdecode') or related MALFEX packages on a Windows system should treat that system as fully compromised. The malware employs anti-analysis evasion, scheduled task persistence ('MicrosoftEdgeUpdateService'), and Registry Run key persistence, indicating a dwell-time-oriented campaign targeting high-value developer environments.
Recommended Actions
Key Takeaways & Next Steps
- • Apply CNSF Egress Security & Policy Enforcement with FQDN filtering and outbound traffic controls to block unauthorized connections from developer workstations or CI/CD pipelines to unknown IPs (e.g., 104.234.65[.]75) and raw GitHub content delivery channels used for shellcode staging, directly disrupting C2 and payload retrieval.
- • Deploy Cloud Firewall (ACF) with AI-based discovery of outbound traffic patterns to detect and block anomalous egress from developer environments to unlisted or newly registered external endpoints, preventing both shellcode download from GitHub and data exfiltration to the C2 WebSocket server.
- • Enforce Zero Trust Segmentation and least-privilege network policies so that developer workstations and CI/CD nodes cannot initiate unsanctioned workload-to-internet or workload-to-workload connections; microsegmentation would limit the blast radius if a compromised package is executed in a shared build environment.
- • Leverage Multicloud Visibility & Control to establish behavioral baselines for developer host traffic and alert on anomalous outbound connection patterns, repeated encrypted payload downloads from code hosting platforms, or new scheduled task creation events that deviate from expected development activity.
- • Enable Inline IPS (Suricata) with signatures covering known malicious payload delivery patterns, shellcode injection into Windows system processes (dllhost.exe), and known MALFEX IOCs (C2 IPs, decryption key strings, GitHub repository paths) to detect and block the loader chain before shellcode execution completes.
