# How a Malicious npm Package Called “imgdecode” Is Targeting Windows Systems
Cybersecurity experts have uncovered a dangerous supply chain attack campaign that has been quietly spreading through the npm package registry for over three years. The campaign, now known as **MALFEX**, uses a series of seemingly harmless development tools as bait to deliver malware to unsuspecting developers.
## What Is the “imgdecode” Package?
A package named **”imgdecode”** was recently uploaded to the npm registry. It appeared as a Node.js addon designed to handle image decoding tasks. However, beneath its simple nine-line JavaScript file lies a hidden threat: a compiled Windows DLL that executes malicious code every time a developer runs `require(‘imgdecode’)` in their project.
The DLL, once activated, connects to an external server to download encrypted malicious code, decrypts it, and then injects it into a legitimate Windows system process called `dllhost.exe`. This makes the malicious activity extremely difficult to detect using standard security tools.
## The Larger MALFEX Campaign
The “imgdecode” package is just the latest chapter in a long-running campaign. An unknown threat actor has been publishing harmful packages to npm since August 2023, operating under multiple publisher accounts. Across these accounts, **eight malicious packages** have been identified.
These packages use different strategies to infect systems:
– **Some act as loaders** for a remote access tool known as **Overlord RAT**, giving attackers full control over a compromised machine.
– **Others work together** in a chain — one package downloads another — ultimately delivering a **Node.js information stealer** that harvests sensitive data.
– **A third method** uses a postinstall hook to automatically execute code when the package is installed, contacting a remote server to fetch additional malware.
## How the Attack Evolved
What makes this campaign particularly notable is how quickly the attacker adapts. When certain packages were discovered and removed from npm, the threat actor replaced them within **two days** with new versions carrying different names. The timeline shows a rapid cycle of publishing, removal, and republishing, demonstrating a sophisticated and determined attacker.
One particularly clever adaptation involved the attacker publishing a version that would **self-disable** if security researchers were serving a harmless image file instead of encrypted payload — essentially an anti-analysis kill switch embedded in the malware itself.
## What Does the Malware Steal?
Once installed, the malware performs several checks to ensure it is not running inside a virtual machine, sandbox, or analysis environment. If it determines the environment is safe, it begins harvesting data including:
– **Cryptocurrency wallet files** and seed phrases
– **Browser data** from Chromium-based browsers (passwords, cookies, saved logins)
– **Communication app data** from Discord and Telegram
– **Gaming platform data** from Steam, Epic Games, Riot Games, Battle.net, Minecraft, and Ubisoft
– **Sensitive file types** such as `.kdbx`, `.pem`, `.ppk`, and `.env` files
The malware also establishes a persistent connection to a command-and-control server, allowing attackers to execute shell commands, transfer files, control processes, capture screenshots, record clipboard data, and even take over the mouse and keyboard remotely.
For persistence, the malware modifies the Windows Registry and creates a fake scheduled task named **”MicrosoftEdgeUpdateService”** to ensure it survives system reboots.
## Who Should Be Concerned?
Any developer or organization that has installed packages from the affected publisher accounts should treat their Windows machines as potentially compromised. The malware specifically targets Windows environments, so Linux and macOS users are not directly affected by this particular campaign.
## Recommended Actions for Developers
If you or your team have installed any of the affected packages, security experts recommend the following steps:
1. **Isolate** the affected machine from the network immediately.
2. **Audit** your system for suspicious registry entries and scheduled tasks.
3. **Rotate all credentials**, especially API keys, passwords, and cryptocurrency wallet seed phrases.
4. **Move funds** to new wallets if seed phrases were stored on the compromised system.
5. **Scan all systems** with updated antivirus and anti-malware tools.
6. **Audit your npm dependencies** to ensure no malicious packages remain in your project.
—
## Frequently Asked Questions (FAQ)
**Q: What is an npm supply chain attack?**
A: An npm supply chain attack occurs when a malicious actor uploads a harmful package to the npm registry, a public package manager for Node.js. When developers install the package, believing it to be a legitimate tool, the malicious code runs on their systems.
**Q: How was this campaign discovered?**
A: The campaign was identified after cybersecurity teams noticed suspicious patterns across multiple npm packages published under different accounts but showing similar malicious behavior. The discovery was made public after the packages had been active for over three years.
**Q: Can I get infected just by viewing a project’s page on npm?**
A: No. Infection only occurs when a developer actively installs and uses the malicious package in their project. Simply browsing npm will not expose you to the malware.
**Q: Why does the malware target gaming platforms?**
A: Gaming platforms like Steam and Epic Games store valuable digital assets, in-game currencies, and payment information. These are attractive targets for cybercriminals who can sell stolen accounts or digital items for profit.
**Q: Is npm taking action against these packages?**
A: Yes. npm has removed several of the identified malicious packages from its registry, including `imgbundle`, `cdn-img-fetch`, and others. However, some packages may still be accessible, which is why vigilance from developers is critical.
**Q: How can I protect my projects from supply chain attacks?**
A: You can reduce risk by regularly auditing your dependencies, using automated security scanning tools, avoiding packages from unknown or unverified publishers, and monitoring npm for any unusual activity in your projects.
**Q: Does this malware affect Mac or Linux systems?**
A: The MALFEX campaign is specifically designed to target Windows systems. However, supply chain attacks can evolve, so developers on all platforms should remain cautious.
—
## Conclusion
The MALFEX campaign is a stark reminder of the persistent risks that come with open-source software dependencies. Supply chain attacks like this one exploit the trust developers place in publicly available packages, turning everyday tools into weapons. The fact that this campaign has operated for over three years — quietly evolving and adapting — underscores the importance of proactive security practices in software development.
Staying informed, regularly auditing your dependencies, and maintaining good security hygiene are the best defenses against these kinds of threats. As the npm ecosystem continues to grow, so does the responsibility on both maintainers and users to keep it safe.
Thank you for reading
