Malicious npm Package ‘imgdecode’ Linked to MALFEX Campaign After 979 Downloads
A package called imgdecode on the npm registry is tied to the MALFEX campaign and conceals a Windows DLL that can fetch encrypted shellcode from GitHub and inject it into dllhost.exe, raising fresh supply‑chain concerns after 979 recorded downloads.
A malicious npm package masquerading as an image‑related tool has quietly reached hundreds of downloads while carrying code linked to a broader Windows attack campaign.
The package, named imgdecode, remains available on the npm registry and has been downloaded 979 times, according to a report on the MALFEX campaign. The campaign targets Windows systems through poisoned open‑source components.
When imgdecode is loaded from a Windows console, it hides a Windows dynamic‑link library (DLL) that can retrieve encrypted shellcode from GitHub. Once fetched, that shellcode is injected into dllhost.exe, a legitimate Windows process, allowing attacker‑controlled code to run under the guise of normal system activity.
Using GitHub as a hosting point for encrypted payloads and dllhost.exe as the execution host complicates detection by basic security tools. Many organizations allow outbound connections to GitHub by default, and dllhost.exe is a common process on Windows machines.
Because npm packages are routinely pulled into development and build environments, even a small number of compromised installations can matter. Workstations, continuous integration servers or production systems that installed imgdecode may have given attackers a route into networks where code, credentials and deployment tools are concentrated.
The imgdecode case fits a wider pattern in which attackers seed malicious components into software supply chains rather than only exploiting vulnerabilities in well‑known applications. By hiding behind obscure packages, they rely on automation in modern development practices to spread their code.
Key developments to watch are whether imgdecode is removed from npm, whether maintainers of affected projects disclose its use in their dependency trees, and if security vendors begin reporting related dllhost.exe shellcode injection activity tied to MALFEX beyond this specific package.
Sources
- OSINT