Hidden Malware in npm Package Affects Thousands of Developers

A malicious npm package named imgdecode conceals malware within GitHub-hosted images as part of an ongoing campaign targeting Windows developers.

NationPulse Desk

Oct 19, 2026 · 9:33 AM 3 min read

Key takeaways

A malicious npm package named imgdecode hides malware inside image files hosted on GitHub.

The MALFEX campaign has targeted Windows developers since August 2023 across eight malicious npm packages.

Combined downloads for the campaign exceed 40,000, with function-flag accounting for over 37,000 downloads.

The malware delivers two distinct families, including the movinlike data stealer and the Overlord RAT.

Researchers recommend treating any Windows system that installed these packages as potentially compromised.

Security analysts at SafeDep identified a harmful npm package named imgdecode that conceals malicious code inside image files stored on GitHub, operating as part of the MALFEX campaign that has aimed at Windows developers since August 2023. Altogether, eight malicious npm packages comprise this effort, accumulating more than 40,000 downloads combined, with a single package titled function-flag responsible for over 37,000 of those downloads by itself.

Contained within the imgdecode package is a compact nine-line JavaScript file responsible for loading a Windows dynamic-link library. Upon loading, this library fetches an encrypted payload disguised as a JPEG from a GitHub repository, decrypts it, and injects shellcode directly into the Windows dllhost.exe process, allowing the threat to operate silently without tripping standard security warnings.

The chronological sequence of occurrences unfolds as follows:

September 26, 2026 - cdn-img-fetch, img-to-native, and native-runner 1.0.0 published
September 28, 2026, at 4:06 p.m. UTC - npm removes native-runner and img-to-native
September 30, 2026, at 3:29 a.m. UTC - imgbundle 1.0.0 published, replacing img-to-native
September 30, 2026, at 3:37 a.m. UTC - runhelper 1.0.0 published, replacing native-runner
September 30, 2026, at 4:13 p.m. UTC - runhelper unpublished
September 30, 2026, at 10:32 p.m. UTC - imgdecode 1.0.0 published
September 30, 2026, at 11:07 p.m. UTC - imgdecode 1.0.1 published
October 1, 2026, at 5:48 p.m. UTC - imgdecode 1.0.2 published
October 7, 2026, at 11:06 p.m. UTC - npm removes imgbundle
October 8, 2026, at 1:03 p.m. UTC - npm removes cdn-img-fetch
October 11, 2026, at 10:09 p.m. UTC - imgdecode 1.0.3 published

"After decryption, the DLL checks the first bytes of the plaintext," SafeDep explained. "If they match a JPEG or PNG signature, the DLL stops. Inference: the operator could turn the loader off by serving encrypted content that decrypts to an image. Serving an ordinary image would instead generally cause decryption to fail before this check."

In addition, the operation distributes two separate malware variants to compromised computers. The first variant is a Node.js information stealer designated as movinlike, which collects data from Chromium-based browsers, Discord, Telegram, and digital currency wallets, while also scanning for seed phrases and private files such as .env and .pem documents. The second variant is the Overlord RAT, an open-source remote access utility built using Go.

At the same time, the person or group operating MALFEX has demonstrated resilience in sustaining the effort. Based on findings from specialists at Checkmarx and CloudSEK, even though npm deleted multiple packages, the operator released substitutes within days, such as imgbundle taking the place of img-to-native and runhelper replacing native-runner, making imgdecode the newest version of this persistent supply chain threat.

The malicious software secures persistence on the target machine using a Windows Registry Run key along with a scheduled task, while the data stealer opens a WebSocket connection to a command-and-control server for remote access capabilities. Consequently, investigators advise treating any Windows computer that installed these packages as potentially breached, while urging users to change login credentials and transfer crypto assets to fresh wallets right away.

Questions and answers