MALFEX: How to Detect & Block imgdecode npm Shellcode Loader

Executive Summary

Security researchers at SafeDep have uncovered a sophisticated software supply chain attack distributed through the public npm registry under the package name imgdecode. The package represents the latest operational evolution of MALFEX, an ongoing cyber espionage and data theft campaign active since August 2023, previously tracked by Checkmarx and CloudSEK.

Uploaded by threat actor persona malfexteste8 and downloaded nearly 1,000 times, imgdecode masquerades as a legitimate image processing library. Unlike traditional malicious JavaScript packages that rely on noisy postinstall lifecycle hooks (which are increasingly flagged by modern package scanners), imgdecode conceals its primary malicious loader inside a precompiled 64-bit Windows dynamic-link library (DLL) compiled as a native Node.js C++ addon.

When imported into a project on a Windows machine, the native DLL retrieves encrypted shellcode steganographically hidden inside an image hosted on GitHub, decrypts the payload in memory, and performs process injection into `dllhost.exe`. The injected shellcode subsequently drops a Go-based downloader and a feature-rich Node.js remote access trojan (RAT) and information stealer, harvesting developer secrets, cloud credentials, browser tokens, and cryptocurrency private keys.

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

The MALFEX threat actor engineered imgdecode to defeat both static source-code analysis and cloud sandboxes through a multi-stage execution model:

[require('imgdecode')] --> Loads Compiled C++ Addon (.node/.dll)
                                   │
                                   ▼
[Terminal Environment Check] -> Verifies Interactive Console Execution
                                   │
                                   ▼
[GitHub Staging Fetch]     --> Downloads 'banner.jpg' from cavecrew/proj
                                   │
                                   ▼
[In-Memory Decryption]     --> Decrypts via Key 'nif-runtime-2027' + Kill-Switch Check
                                   │
                                   ▼
[Process Injection]        --> Injects Shellcode into dllhost.exe (COM Surrogate)
                                   │
                                   ▼
[Payload Execution]        --> Spawns node_runtime_helper.exe & Fetches 'movinlike' Stealer

1. Native Addon Weaponization:

The package contains a minimal 9-line JavaScript entry point (index.js) that simply exports a compiled native Node.js addon:

const binary = require('./build/Release/imgdecode.node');
module.exports = binary;

Because standard npm security tools primarily scan JavaScript source trees for patterns like child_process.exec or eval(), the malicious logic residing inside the compiled C++ binary bypassed automated registry filters entirely.

1. Environment & Terminal Gating:

Upon execution, the DLL queries the Windows API to verify whether the host process is running in an interactive developer terminal. If the execution environment appears to be an automated analysis sandbox or headless CI/CD runner lacking standard console buffers, the addon quietly exits.

1. Steganographic Staging & Kill-Switch Validation:

The native DLL connects via HTTPS to a public GitHub repository (cavecrew/proj) to download an image asset named banner.jpg (or banner.png). The payload is encrypted and embedded within the file structure.

The binary decrypts the payload buffer in memory using the hardcoded key `nif-runtime-2027` (earlier variants used malfexteam2027). Crucially, the loader inspects the first bytes of the decrypted plaintext:

• If the decrypted bytes match a standard JPEG (FF D8 FF) or PNG (89 50 4E 47) file signature, the DLL immediately terminates.
• This design functions as an operational kill-switch: the threat actor can neutralize active infections across all victim endpoints simply by committing a genuinely encrypted real image file to the repository.

1. Process Injection into dllhost.exe:

Once decrypted shellcode is validated, the DLL spawns a legitimate Windows COM Surrogate process (dllhost.exe) in a suspended state. Using standard memory allocation and thread creation APIs (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread), the addon injects the shellcode into dllhost.exe to conceal network traffic and execution under a trusted system binary.

1. Payload Staging: node_runtime_helper.exe & movinlike:

The injected shellcode drops an executable onto disk at:

%APPDATA%\Microsoft\Windows\node_runtime_helper.exe

This Go-based binary reaches out to the threat actor's command-and-control server at `104.234.65[.]75:700` to download the primary infostealer payload, tracked as setup.exe (internally designated `movinlike`).

Post-Exploitation Tooling: Credential Harvesting & WebSocket RAT

The deployed Node.js malware incorporates a commercial or builder-generated licensing system featuring a local .env configuration file pointing to `104.234.65[.]75:7007`:

• Anti-Analysis Protections: Checks for virtualization software, automated sandboxes, and debugging utilities including Wireshark, Process Monitor, and x64dbg.
• Developer Secret Exfiltration: Recursively scans local drives for software development artifacts, targeting seed phrases, private SSH keys (.pem, .ppk), KeePass databases (.kdbx), and environment configuration files (.env).
• Identity & Application Theft: Harvests saved credentials, session cookies, and autofill data from Chromium-based browsers, alongside Discord authentication tokens, Telegram desktop sessions, and gaming platform profiles (Steam, Epic Games, Riot Games, Battle.net).
• Interactive WebSocket C2: Establishes a persistent bidirectional WebSocket tunnel, granting operators remote interactive shell execution, desktop screenshot streaming, clipboard monitoring, arbitrary file transfer, and remote process manipulation.
• Persistence Mechanism: Establishes survivability across reboots by appending a Run key in the Windows Registry (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) and creating a scheduled task deceptively named `MicrosoftEdgeUpdateService`.

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

The MALFEX threat operation has demonstrated persistent activity targeting developer workstations since August 2023. Telemetry from Checkmarx, CloudSEK, and SafeDep tracks multiple publisher accounts controlled by the same operator:

• Known Publisher Accounts: malfexteste8, malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4.
• Evolving Package Pipeline: As security researchers and npm administrators remove flagged packages, the threat actor publishes near-immediate functional replacements:
  • Phase 1: Packages cdn-img-fetch, img-to-native, and native-runner collaborated to drop the Go helper.
  • Phase 2: Following npm takedowns, the actor deployed imgbundle and runhelper utilizing the Koffi Foreign Function Interface (FFI) module.
  • Phase 3: The operator consolidated the entire multi-package attack chain into standalone imgdecode versions (1.0.0 through 1.0.3), embedding compiled C++ native addons to eliminate external npm dependencies.

Detection & SOC Mitigation Playbook

1. Concrete Remediation & Workarounds

Organizations with developers working in Node.js / JavaScript environments must execute the following remediation actions immediately:

Step 1: Audit and Remove Malicious npm Dependencies Search all internal project repositories, lockfiles, and developer workstations for references to MALFEX packages:

# Search package.json and lockfiles for MALFEX packages
Get-ChildItem -Path C:\ -Include "package.json", "package-lock.json", "yarn.lock" -Recurse -ErrorAction SilentlyContinue | 
    Select-String -Pattern 'imgdecode|runhelper|imgbundle|cdn-img-fetch|img-to-native|native-runner' | 
    Select-Object Path, LineNumber, Line

If found, immediately uninstall the package (npm uninstall imgdecode), delete node_modules, and purge the global npm cache (npm cache clean --force).

Step 2: Terminate Injected Processes and Eradicate Host Artifacts Inspect developer endpoints for active MALFEX processes and binaries:

# Terminate suspicious dllhost or node processes connecting outbound
Get-Process -Name "node_runtime_helper", "setup" -ErrorAction SilentlyContinue | Stop-Process -Force

# Delete the dropped Go helper executable
Remove-Item -Path "$env:APPDATA\Microsoft\Windows\node_runtime_helper.exe" -Force -ErrorAction SilentlyContinue

Step 3: Remove Persistence Scheduled Task and Registry Run Keys Purge rogue autostart entries established by the malware:

# Remove the deceptive Edge update scheduled task
Unregister-ScheduledTask -TaskName "MicrosoftEdgeUpdateService" -Confirm:$false -ErrorAction SilentlyContinue

# Audit and remove unauthorized HKCU Run keys
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | 
    Format-List

Step 4: Rotate Developer Secrets and Invalidate Tokens Because the malware specifically exfiltrates credentials, assume complete compromise of the workstation:

• Invalidate all API keys, database credentials, and secrets present in local .env files.
• Revoke and regenerate all SSH keypairs (id_rsa, id_ed25519) and cloud provider access tokens (AWS, GCP, Azure).
• Transfer cryptocurrency assets from local desktop wallets (Metamask, Exodus, Electrum) to fresh hardware-backed wallets.

2. Network & Perimeter Defenses

• Block MALFEX C2 Infrastructure: Add 104.234.65.75 to perimeter firewall and DNS blocklists, dropping all outbound TCP traffic on ports 700 and 7007.
• Enforce Package Signing and Private Registries: Mandate the use of enterprise artifact repositories (such as JFrog Artifactory or Sonatype Nexus) with automated SCA scanning to block newly published, unvetted npm packages containing compiled native addons.

3. Endpoint Detection & Hunting Query

Sigma Rule: Node.js Spawning Injected dllhost.exe or Native Helper

title: Node.js Spawning Suspicious dllhost or Runtime Helper
id: f48b1923-8c41-4792-911b-7a3d90214ef1
status: experimental
description: Detects node.exe spawning dllhost.exe or dropping node_runtime_helper.exe in APPDATA, characteristic of MALFEX imgdecode supply chain attacks.
author: CyberNewsAI Threat Research Team
references:
  - https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html?ref=cybernewsai.com
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\dllhost.exe'
      - '\node_runtime_helper.exe'
      - '\setup.exe'
  selection_path:
    CommandLine|contains:
      - '\AppData\Roaming\Microsoft\Windows\node_runtime_helper.exe'
      - 'MicrosoftEdgeUpdateService'
  condition: (selection_parent and selection_child) or selection_path
falsepositives:
  - Legitimate enterprise Node.js applications interacting with COM surrogates (rare)
level: high
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.defense_evasion
  - attack.t1055.001

Microsoft Sentinel / Defender KQL Hunting Query

// Hunt for MALFEX supply chain execution and suspicious dllhost injection
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where (InitiatingProcessFileName =~ "node.exe" and FileName in~ ("dllhost.exe", "node_runtime_helper.exe"))
    or (ProcessCommandLine has @"MicrosoftWindows
ode_runtime_helper.exe")
    or (ProcessCommandLine has "MicrosoftEdgeUpdateService" and InitiatingProcessFileName !in~ ("msedge.exe", "MicrosoftEdgeUpdate.exe"))
    or (ProcessCommandLine has "nif-runtime-2027" or ProcessCommandLine has "cavecrew/proj")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath
| sort by Timestamp desc

Splunk SPL Hunting Query

index=endpoint (sourcetype=WinEventLog:Security EventCode=4688) OR (sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1)
| eval ParentImage=lower(parent_process_name), Image=lower(process_name), Cmd=lower(process)
| where (like(ParentImage, "%node.exe") AND (like(Image, "%dllhost.exe") OR like(Image, "%node_runtime_helper.exe")))
     OR (like(Cmd, "%node_runtime_helper.exe%") OR like(Cmd, "%microsoftedgeupdateservice%"))
     OR (like(Cmd, "%104.234.65.75%"))
| table _time, host, user, parent_process_name, process_name, process

The following Indicators of Compromise represent authenticated indicators verified against research disclosures by SafeDep, Checkmarx, and CloudSEK.

Network C2 Infrastructure & Staging Endpoints

Host Filesystem Artifacts & Decryption Keys

Malicious npm Packages & Publisher Accounts