---
title: Hunt: MALFEX on Windows dev boxes (imgdecode/imgbundle/runhelper, cavecrew/proj, dllhost injection, node_runtime_helper.exe) | ctxsec
url: https://ctxsec.com/items/hunt-malfex-imgdecode
description: ""
status: "hunt idea (researcher IOCs)"
published: 2026-10-17
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-malfex-imgdecode.md)

hunt idea (researcher IOCs)

2026-10-17

### Hunt: MALFEX on Windows dev boxes (imgdecode/imgbundle/runhelper, cavecrew/proj, dllhost injection, node_runtime_helper.exe)

(1) Lockfiles and SBOMs for imgdecode, imgbundle, runhelper, native-runner, img-to-native or cdn-img-fetch; (2) node.exe fetching raw.githubusercontent.com/cavecrew/proj/main/banner.jpg or banner.png; (3) node.exe spawning a suspended dllhost.exe; (4) %APPDATA%\Microsoft\Windows\node_runtime_helper.exe; (5) connections to 104.234.65[.]75:700. Treat any workstation that loaded imgdecode as compromised.

Sources: [SafeDep](https://safedep.io/malfex-imgdecode-npm-native-addon-loader/) · [The Hacker News (timeline)](https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html)